cowrie.log

2017-04-12T18:59:15+0000 [CowrieTelnetTransport,224550,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:18+0000 [CowrieTelnetTransport,224550,52.27.104.84] login attempt [admin/admin1234] failed
2017-04-12T18:59:18+0000 [CowrieTelnetTransport,224550,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:18+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 220.133.39.64:43887 (10.8.41.81:2223) [session: TT224554]
2017-04-12T18:59:18+0000 [SSHChannel None (308) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T18:59:18+0000 [SSHChannel None (308) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T18:59:18+0000 [SSHChannel None (308) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 308
2017-04-12T18:59:18+0000 [SSHChannel None (62) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] direct-tcp forward to 54.243.252.241:443 with data '\x16\x03\x01\x00\xaa\x01\x00\x00\xa6\x03\x01X\xeex\xee\xbe\xb1\x1fa\xee\xf6?\xac\x9f\xa1.\xc0\xf2\x00\x89r\xec3${\xa0>zn\x10\xb3D\xcb B-hw]:sC\x94\xd5"\x13\xb5!\x8a\x8e$\x99\x96e\x97^\\\x83]\x94\x02\xbb\x15\x90\xcb\x86\x00\x18\xc0\x14\xc0\x13\x005\x00/\xc0\n\xc0\t\x008\x002\x00\n\x00\x13\x00\x05\x00\x04\x01\x00\x00E\x00\x00\x00$\x00"\x00\x00\x1fru.socialclub.rockstargames.com\x00\n\x00\x06\x00\x04\x00\x17\x00\x18\x00\x0b\x00\x02\x01\x00\x00#\x00\x00\x00\x17\x00\x00\xff\x01\x00\x01\x00'
2017-04-12T18:59:18+0000 [SSHChannel None (62) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] failed to connect: Connection refused
2017-04-12T18:59:18+0000 [SSHChannel None (62) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] sending close 62
2017-04-12T18:59:18+0000 [CowrieTelnetTransport,224551,92.253.93.137] login attempt: 13
2017-04-12T18:59:18+0000 [CowrieTelnetTransport,224551,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T18:59:20+0000 [CowrieTelnetTransport,224551,92.253.93.137] login attempt [admin/123456] failed
2017-04-12T18:59:21+0000 [CowrieTelnetTransport,224551,92.253.93.137] Warning: state changed and new state returned
2017-04-12T18:59:21+0000 [CowrieTelnetTransport,224547,1.160.31.76] Received unhandled keyID: '\x00'
2017-04-12T18:59:21+0000 [CowrieTelnetTransport,224547,1.160.31.76] CMD: /bin/busybox MIRAI
2017-04-12T18:59:21+0000 [CowrieTelnetTransport,224547,1.160.31.76] Command found: /bin/busybox MIRAI
2017-04-12T18:59:21+0000 [CowrieTelnetTransport,224550,52.27.104.84] login attempt: 235
2017-04-12T18:59:21+0000 [CowrieTelnetTransport,224550,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:23+0000 [CowrieTelnetTransport,224550,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T18:59:23+0000 [CowrieTelnetTransport,224550,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:24+0000 [CowrieTelnetTransport,224550,52.27.104.84] login attempt: 236
2017-04-12T18:59:24+0000 [CowrieTelnetTransport,224550,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:26+0000 [CowrieTelnetTransport,224550,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T18:59:26+0000 [CowrieTelnetTransport,224550,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:26+0000 [HoneyPotSSHTransport,107220,58.218.204.188] Remote SSH version: SSH-2.0-PUTTY
2017-04-12T18:59:26+0000 [HoneyPotSSHTransport,107220,58.218.204.188] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
2017-04-12T18:59:26+0000 [HoneyPotSSHTransport,107220,58.218.204.188] outgoing: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T18:59:26+0000 [HoneyPotSSHTransport,107220,58.218.204.188] incoming: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T18:59:26+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] got channel 'direct-tcpip' request
2017-04-12T18:59:26+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] direct-tcp connection request to 54.243.252.241:443 from localhost:5556
2017-04-12T18:59:26+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:40481 (10.8.41.81:2223) [session: TT224555]
2017-04-12T18:59:26+0000 [HoneyPotSSHTransport,107220,58.218.204.188] connection lost
2017-04-12T18:59:26+0000 [HoneyPotSSHTransport,107220,58.218.204.188] Connection lost after 11 seconds
2017-04-12T18:59:26+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:57054 (10.8.41.81:2223) [session: TT224556]
2017-04-12T18:59:26+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:49875 (10.8.41.81:2223) [session: TT224557]
2017-04-12T18:59:26+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 92.253.93.137:47643 (10.8.41.81:2223) [session: TT224558]
2017-04-12T18:59:26+0000 [CowrieTelnetTransport,224553,52.27.104.84] login attempt: 237
2017-04-12T18:59:26+0000 [CowrieTelnetTransport,224553,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:29+0000 [CowrieTelnetTransport,224553,52.27.104.84] login attempt [root/juantech] failed
2017-04-12T18:59:29+0000 [CowrieTelnetTransport,224553,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:29+0000 [CowrieTelnetTransport,224552,52.27.104.84] login attempt: 238
2017-04-12T18:59:29+0000 [CowrieTelnetTransport,224552,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:31+0000 [CowrieTelnetTransport,224552,52.27.104.84] login attempt [admin/123456] failed
2017-04-12T18:59:31+0000 [CowrieTelnetTransport,224552,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:31+0000 [CowrieTelnetTransport,224551,92.253.93.137] Connection lost after 19 seconds
2017-04-12T18:59:31+0000 [CowrieTelnetTransport,224547,1.160.31.76] Closing TTY Log: log/tty/20170412-185848-None-224547i.log after 43 seconds
2017-04-12T18:59:31+0000 [CowrieTelnetTransport,224547,1.160.31.76] honeypot terminal protocol connection lost [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly.
	]
2017-04-12T18:59:31+0000 [CowrieTelnetTransport,224547,1.160.31.76] Connection lost after 51 seconds
2017-04-12T18:59:33+0000 [CowrieTelnetTransport,224554,220.133.39.64] login attempt: 3
2017-04-12T18:59:33+0000 [CowrieTelnetTransport,224554,220.133.39.64] login return, expect: [root/1001chin]
2017-04-12T18:59:36+0000 [CowrieTelnetTransport,224554,220.133.39.64] login attempt [root/1001chin\x00] succeeded
2017-04-12T18:59:37+0000 [CowrieTelnetTransport,224554,220.133.39.64] Opening TTY Log: log/tty/20170412-185937-None-224554i.log
2017-04-12T18:59:37+0000 [CowrieTelnetTransport,224554,220.133.39.64] Warning: state changed and new state returned
2017-04-12T18:59:37+0000 [SSHChannel None (63) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] remote eof
2017-04-12T18:59:37+0000 [SSHChannel None (63) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] remote close
2017-04-12T18:59:37+0000 [SSHChannel None (63) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] sending close 63
2017-04-12T18:59:37+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 164.52.9.62:42614 (10.8.41.81:2223) [session: TT224559]
2017-04-12T18:59:37+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T18:59:37+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 104.44.194.237:25 from localhost:5556
2017-04-12T18:59:37+0000 [CowrieTelnetTransport,224548,52.27.104.84] Connection lost after 57 seconds
2017-04-12T18:59:38+0000 [CowrieTelnetTransport,224554,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T18:59:38+0000 [CowrieTelnetTransport,224553,52.27.104.84] login attempt: 239
2017-04-12T18:59:38+0000 [CowrieTelnetTransport,224553,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:40+0000 [CowrieTelnetTransport,224553,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T18:59:40+0000 [CowrieTelnetTransport,224553,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:41+0000 [CowrieTelnetTransport,224553,52.27.104.84] login attempt: 240
2017-04-12T18:59:41+0000 [CowrieTelnetTransport,224553,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:43+0000 [CowrieTelnetTransport,224553,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T18:59:43+0000 [CowrieTelnetTransport,224553,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:43+0000 [CowrieTelnetTransport,224552,52.27.104.84] login attempt: 241
2017-04-12T18:59:43+0000 [CowrieTelnetTransport,224552,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:46+0000 [CowrieTelnetTransport,224552,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T18:59:46+0000 [CowrieTelnetTransport,224552,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:46+0000 [CowrieTelnetTransport,224552,52.27.104.84] login attempt: 242
2017-04-12T18:59:46+0000 [CowrieTelnetTransport,224552,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:48+0000 [CowrieTelnetTransport,224552,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T18:59:48+0000 [CowrieTelnetTransport,224552,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:48+0000 [CowrieTelnetTransport,224554,220.133.39.64] CMD: enable
2017-04-12T18:59:48+0000 [CowrieTelnetTransport,224554,220.133.39.64] Command found: enable 
2017-04-12T18:59:48+0000 [CowrieTelnetTransport,224554,220.133.39.64] Reading txtcmd from "txtcmds/bin/enable"
2017-04-12T18:59:48+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:27039 (10.8.41.81:2222) [session: 85ee3c02]
2017-04-12T18:59:49+0000 [CowrieTelnetTransport,224555,52.27.104.84] login attempt: 243
2017-04-12T18:59:49+0000 [CowrieTelnetTransport,224555,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:51+0000 [CowrieTelnetTransport,224555,52.27.104.84] login attempt [root/klv123] failed
2017-04-12T18:59:51+0000 [CowrieTelnetTransport,224555,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:51+0000 [CowrieTelnetTransport,224558,92.253.93.137] Connection lost after 25 seconds
2017-04-12T18:59:51+0000 [CowrieTelnetTransport,224546,52.27.104.84] Connection lost after 70 seconds
2017-04-12T18:59:51+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 92.253.93.137:47745 (10.8.41.81:2223) [session: TT224560]
2017-04-12T18:59:51+0000 [HoneyPotSSHTransport,107221,58.218.204.188] Got remote error, code 11
	reason: 
2017-04-12T18:59:51+0000 [HoneyPotSSHTransport,107221,58.218.204.188] connection lost
2017-04-12T18:59:51+0000 [HoneyPotSSHTransport,107221,58.218.204.188] Connection lost after 2 seconds
2017-04-12T18:59:51+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T18:59:51+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 104.44.194.237:25 from localhost:5556
2017-04-12T18:59:51+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:55717 (10.8.41.81:2223) [session: TT224561]
2017-04-12T18:59:51+0000 [CowrieTelnetTransport,224554,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T18:59:52+0000 [CowrieTelnetTransport,224555,52.27.104.84] login attempt: 244
2017-04-12T18:59:52+0000 [CowrieTelnetTransport,224555,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:54+0000 [CowrieTelnetTransport,224555,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T18:59:54+0000 [CowrieTelnetTransport,224555,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:54+0000 [CowrieTelnetTransport,224555,52.27.104.84] login attempt: 245
2017-04-12T18:59:54+0000 [CowrieTelnetTransport,224555,52.27.104.84] login return, expect: [user/user]
2017-04-12T18:59:57+0000 [CowrieTelnetTransport,224555,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T18:59:57+0000 [CowrieTelnetTransport,224555,52.27.104.84] Warning: state changed and new state returned
2017-04-12T18:59:57+0000 [CowrieTelnetTransport,224554,220.133.39.64] CMD: system
2017-04-12T18:59:57+0000 [CowrieTelnetTransport,224554,220.133.39.64] Command not found: system
2017-04-12T18:59:57+0000 [CowrieTelnetTransport,224554,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T18:59:57+0000 [CowrieTelnetTransport,224554,220.133.39.64] CMD: shell
2017-04-12T18:59:57+0000 [CowrieTelnetTransport,224554,220.133.39.64] Command not found: shell
2017-04-12T18:59:59+0000 [CowrieTelnetTransport,224560,92.253.93.137] login attempt: 14
2017-04-12T18:59:59+0000 [CowrieTelnetTransport,224560,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:00:02+0000 [CowrieTelnetTransport,224560,92.253.93.137] login attempt [admin/7ujMko0admin] failed
2017-04-12T19:00:02+0000 [CowrieTelnetTransport,224560,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:00:02+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] got channel 'direct-tcpip' request
2017-04-12T19:00:02+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] direct-tcp connection request to 98.136.217.203:25 from localhost:5556
2017-04-12T19:00:02+0000 [CowrieTelnetTransport,224557,52.27.104.84] login attempt: 246
2017-04-12T19:00:02+0000 [CowrieTelnetTransport,224557,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:04+0000 [CowrieTelnetTransport,224557,52.27.104.84] login attempt [admin/password] failed
2017-04-12T19:00:04+0000 [CowrieTelnetTransport,224557,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:05+0000 [CowrieTelnetTransport,224556,52.27.104.84] login attempt: 247
2017-04-12T19:00:05+0000 [CowrieTelnetTransport,224556,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:07+0000 [CowrieTelnetTransport,224556,52.27.104.84] login attempt [root/vizxv] failed
2017-04-12T19:00:07+0000 [CowrieTelnetTransport,224556,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:08+0000 [CowrieTelnetTransport,224559,164.52.9.62] login attempt: 708
2017-04-12T19:00:08+0000 [CowrieTelnetTransport,224559,164.52.9.62] login return, expect: [root/default]
2017-04-12T19:00:10+0000 [CowrieTelnetTransport,224559,164.52.9.62] login attempt [admin/] failed
2017-04-12T19:00:10+0000 [CowrieTelnetTransport,224559,164.52.9.62] Warning: state changed and new state returned
2017-04-12T19:00:10+0000 [CowrieTelnetTransport,224560,92.253.93.137] Connection lost after 19 seconds
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 104.44.194.236:25 from localhost:5556
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 65.55.92.184:25 from localhost:5556
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 104.44.194.234:25 from localhost:5556
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 65.55.92.184:25 from localhost:5556
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 104.44.194.232:25 from localhost:5556
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 65.55.37.104:25 from localhost:5556
2017-04-12T19:00:10+0000 [CowrieTelnetTransport,224550,52.27.104.84] Connection lost after 74 seconds
2017-04-12T19:00:10+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:44240 (10.8.41.81:2222) [session: 9c64c973]
2017-04-12T19:00:10+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 92.253.93.137:47838 (10.8.41.81:2223) [session: TT224562]
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 207.46.8.199:25 from localhost:5556
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:10+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 212.6.122.250:25 from localhost:5556
2017-04-12T19:00:10+0000 [CowrieTelnetTransport,224554,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:00:11+0000 [CowrieTelnetTransport,224557,52.27.104.84] login attempt: 248
2017-04-12T19:00:11+0000 [CowrieTelnetTransport,224557,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:13+0000 [CowrieTelnetTransport,224557,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T19:00:13+0000 [CowrieTelnetTransport,224557,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:14+0000 [CowrieTelnetTransport,224557,52.27.104.84] login attempt: 249
2017-04-12T19:00:14+0000 [CowrieTelnetTransport,224557,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:16+0000 [CowrieTelnetTransport,224557,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T19:00:16+0000 [CowrieTelnetTransport,224557,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:16+0000 [CowrieTelnetTransport,224559,164.52.9.62] login attempt: 709
2017-04-12T19:00:16+0000 [CowrieTelnetTransport,224559,164.52.9.62] login return, expect: [root/default]
2017-04-12T19:00:19+0000 [CowrieTelnetTransport,224559,164.52.9.62] login attempt [enable/shell] failed
2017-04-12T19:00:19+0000 [CowrieTelnetTransport,224559,164.52.9.62] Warning: state changed and new state returned
2017-04-12T19:00:19+0000 [CowrieTelnetTransport,224556,52.27.104.84] login attempt: 250
2017-04-12T19:00:19+0000 [CowrieTelnetTransport,224556,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:21+0000 [CowrieTelnetTransport,224556,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T19:00:21+0000 [CowrieTelnetTransport,224556,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:22+0000 [CowrieTelnetTransport,224556,52.27.104.84] login attempt: 251
2017-04-12T19:00:22+0000 [CowrieTelnetTransport,224556,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:24+0000 [CowrieTelnetTransport,224556,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T19:00:24+0000 [CowrieTelnetTransport,224556,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:24+0000 [HoneyPotSSHTransport,107222,58.218.204.188] Remote SSH version: SSH-2.0-PUTTY
2017-04-12T19:00:24+0000 [HoneyPotSSHTransport,107222,58.218.204.188] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
2017-04-12T19:00:24+0000 [HoneyPotSSHTransport,107222,58.218.204.188] outgoing: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:00:24+0000 [HoneyPotSSHTransport,107222,58.218.204.188] incoming: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:00:24+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:32834 (10.8.41.81:2223) [session: TT224563]
2017-04-12T19:00:25+0000 [CowrieTelnetTransport,224562,92.253.93.137] login attempt: 15
2017-04-12T19:00:25+0000 [CowrieTelnetTransport,224562,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:00:27+0000 [CowrieTelnetTransport,224562,92.253.93.137] login attempt [admin/admin] failed
2017-04-12T19:00:27+0000 [CowrieTelnetTransport,224562,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:00:27+0000 [CowrieTelnetTransport,224554,220.133.39.64] CMD: sh
2017-04-12T19:00:27+0000 [CowrieTelnetTransport,224554,220.133.39.64] Command found: sh 
2017-04-12T19:00:27+0000 [SSHChannel None (310) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:00:27+0000 [SSHChannel None (310) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:00:27+0000 [SSHChannel None (310) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 310
2017-04-12T19:00:27+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:27+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 104.44.194.237:25 from localhost:5556
2017-04-12T19:00:27+0000 [SSHChannel None (309) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:00:27+0000 [SSHChannel None (309) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:00:27+0000 [SSHChannel None (309) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 309
2017-04-12T19:00:27+0000 [SSHChannel None (311) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:00:27+0000 [SSHChannel None (311) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:00:27+0000 [SSHChannel None (311) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 311
2017-04-12T19:00:27+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:27+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 65.54.188.72:25 from localhost:5556
2017-04-12T19:00:29+0000 [CowrieTelnetTransport,224561,52.27.104.84] login attempt: 252
2017-04-12T19:00:29+0000 [CowrieTelnetTransport,224561,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:32+0000 [CowrieTelnetTransport,224561,52.27.104.84] login attempt [root/xc3511] failed
2017-04-12T19:00:32+0000 [CowrieTelnetTransport,224561,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:32+0000 [HoneyPotSSHTransport,107222,58.218.204.188] connection lost
2017-04-12T19:00:32+0000 [HoneyPotSSHTransport,107222,58.218.204.188] Connection lost after 21 seconds
2017-04-12T19:00:32+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 92.253.93.137:47915 (10.8.41.81:2223) [session: TT224564]
2017-04-12T19:00:32+0000 [CowrieTelnetTransport,224562,92.253.93.137] Connection lost after 21 seconds
2017-04-12T19:00:32+0000 [CowrieTelnetTransport,224553,52.27.104.84] Connection lost after 80 seconds
2017-04-12T19:00:32+0000 [CowrieTelnetTransport,224552,52.27.104.84] Connection lost after 80 seconds
2017-04-12T19:00:32+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] got channel 'direct-tcpip' request
2017-04-12T19:00:32+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] direct-tcp connection request to 173.230.217.202:443 from localhost:5556
2017-04-12T19:00:32+0000 [CowrieTelnetTransport,224555,52.27.104.84] Connection lost after 65 seconds
2017-04-12T19:00:32+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107085,91.230.47.81] got channel 'direct-tcpip' request
2017-04-12T19:00:32+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107085,91.230.47.81] direct-tcp connection request to 185.86.151.225:80 from localhost:5556
2017-04-12T19:00:32+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:49645 (10.8.41.81:2223) [session: TT224565]
2017-04-12T19:00:32+0000 [SSHChannel None (64) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] remote eof
2017-04-12T19:00:32+0000 [SSHChannel None (64) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] remote close
2017-04-12T19:00:32+0000 [SSHChannel None (64) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] sending close 64
2017-04-12T19:00:32+0000 [CowrieTelnetTransport,224554,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:00:33+0000 [CowrieTelnetTransport,224561,52.27.104.84] login attempt: 253
2017-04-12T19:00:33+0000 [CowrieTelnetTransport,224561,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:35+0000 [CowrieTelnetTransport,224561,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T19:00:35+0000 [CowrieTelnetTransport,224561,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:35+0000 [CowrieTelnetTransport,224561,52.27.104.84] login attempt: 254
2017-04-12T19:00:35+0000 [CowrieTelnetTransport,224561,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:38+0000 [CowrieTelnetTransport,224561,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T19:00:38+0000 [CowrieTelnetTransport,224561,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:38+0000 [CowrieTelnetTransport,224564,92.253.93.137] login attempt: 16
2017-04-12T19:00:38+0000 [CowrieTelnetTransport,224564,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:00:40+0000 [CowrieTelnetTransport,224564,92.253.93.137] login attempt [root/] failed
2017-04-12T19:00:40+0000 [CowrieTelnetTransport,224564,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:00:41+0000 [CowrieTelnetTransport,224559,164.52.9.62] login attempt: 710
2017-04-12T19:00:41+0000 [CowrieTelnetTransport,224559,164.52.9.62] login return, expect: [root/default]
2017-04-12T19:00:43+0000 [CowrieTelnetTransport,224559,164.52.9.62] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T19:00:43+0000 [CowrieTelnetTransport,224559,164.52.9.62] Warning: state changed and new state returned
2017-04-12T19:00:43+0000 [SSHChannel None (15) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107085,91.230.47.81] direct-tcp forward to 185.86.151.225:80 with data 'GET /getip.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0\r\nHost: hipcow.pw\r\nAccept: */*\r\n\r\n'
2017-04-12T19:00:43+0000 [SSHChannel None (15) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107085,91.230.47.81] failed to connect: Connection refused
2017-04-12T19:00:43+0000 [SSHChannel None (15) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107085,91.230.47.81] sending close 15
2017-04-12T19:00:43+0000 [SSHChannel None (15) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107085,91.230.47.81] remote eof
2017-04-12T19:00:43+0000 [SSHChannel None (15) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107085,91.230.47.81] remote close
2017-04-12T19:00:43+0000 [CowrieTelnetTransport,224554,220.133.39.64] CMD: fgrep XDVR /mnt/mtd/dep2.sh
2017-04-12T19:00:43+0000 [CowrieTelnetTransport,224554,220.133.39.64] Command found: fgrep XDVR /mnt/mtd/dep2.sh
2017-04-12T19:00:43+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:14876 (10.8.41.81:2222) [session: d70f68e9]
2017-04-12T19:00:43+0000 [SSHChannel None (72) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] remote eof
2017-04-12T19:00:43+0000 [SSHChannel None (72) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] remote close
2017-04-12T19:00:43+0000 [SSHChannel None (72) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] sending close 72
2017-04-12T19:00:43+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] got channel 'direct-tcpip' request
2017-04-12T19:00:43+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] direct-tcp connection request to 66.196.118.240:25 from localhost:5556
2017-04-12T19:00:43+0000 [CowrieTelnetTransport,224540,52.27.104.84] Closing TTY Log: log/tty/20170412-185812-None-224540i.log after 150 seconds
2017-04-12T19:00:43+0000 [CowrieTelnetTransport,224540,52.27.104.84] honeypot terminal protocol connection lost [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly.
	]
2017-04-12T19:00:43+0000 [CowrieTelnetTransport,224540,52.27.104.84] Connection lost after 189 seconds
2017-04-12T19:00:43+0000 [HoneyPotSSHTransport,107223,58.218.204.188] Got remote error, code 11
	reason: 
2017-04-12T19:00:43+0000 [HoneyPotSSHTransport,107223,58.218.204.188] connection lost
2017-04-12T19:00:43+0000 [HoneyPotSSHTransport,107223,58.218.204.188] Connection lost after 0 seconds
2017-04-12T19:00:44+0000 [SSHChannel None (314) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:00:44+0000 [CowrieTelnetTransport,224564,92.253.93.137] login attempt: 17
2017-04-12T19:00:44+0000 [CowrieTelnetTransport,224564,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:00:47+0000 [CowrieTelnetTransport,224564,92.253.93.137] login attempt [root/hi3518] failed
2017-04-12T19:00:47+0000 [CowrieTelnetTransport,224564,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:00:47+0000 [CowrieTelnetTransport,224565,52.27.104.84] login attempt: 255
2017-04-12T19:00:47+0000 [CowrieTelnetTransport,224565,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:49+0000 [CowrieTelnetTransport,224565,52.27.104.84] login attempt [root/vizxv] failed
2017-04-12T19:00:49+0000 [CowrieTelnetTransport,224565,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:50+0000 [CowrieTelnetTransport,224563,52.27.104.84] login attempt: 256
2017-04-12T19:00:50+0000 [CowrieTelnetTransport,224563,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:52+0000 [CowrieTelnetTransport,224563,52.27.104.84] login attempt [root/12345] failed
2017-04-12T19:00:52+0000 [CowrieTelnetTransport,224563,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:52+0000 [SSHChannel None (314) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:00:52+0000 [SSHChannel None (314) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 314
2017-04-12T19:00:52+0000 [SSHChannel None (315) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp forward to 94.245.120.74:25 with data 'QUIT\r\n'
2017-04-12T19:00:52+0000 [SSHChannel None (315) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] failed to connect: Connection refused
2017-04-12T19:00:52+0000 [SSHChannel None (315) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 315
2017-04-12T19:00:52+0000 [SSHChannel None (315) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:00:52+0000 [SSHChannel None (315) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:00:52+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:52+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 65.55.37.88:25 from localhost:5556
2017-04-12T19:00:52+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:52+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 207.46.8.199:25 from localhost:5556
2017-04-12T19:00:52+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:00:52+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 173.203.2.32:25 from localhost:5556
2017-04-12T19:00:52+0000 [SSHChannel None (312) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:00:52+0000 [CowrieTelnetTransport,224557,52.27.104.84] Connection lost after 86 seconds
2017-04-12T19:00:52+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 92.253.93.137:47994 (10.8.41.81:2223) [session: TT224566]
2017-04-12T19:00:52+0000 [CowrieTelnetTransport,224564,92.253.93.137] Connection lost after 20 seconds
2017-04-12T19:00:53+0000 [CowrieTelnetTransport,224565,52.27.104.84] login attempt: 257
2017-04-12T19:00:53+0000 [CowrieTelnetTransport,224565,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:00:55+0000 [CowrieTelnetTransport,224565,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T19:00:55+0000 [CowrieTelnetTransport,224565,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:00:58+0000 [CowrieTelnetTransport,224565,52.27.104.84] login attempt: 258
2017-04-12T19:00:58+0000 [CowrieTelnetTransport,224565,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:01:00+0000 [CowrieTelnetTransport,224565,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T19:01:00+0000 [CowrieTelnetTransport,224565,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:01:00+0000 [CowrieTelnetTransport,224563,52.27.104.84] login attempt: 259
2017-04-12T19:01:00+0000 [CowrieTelnetTransport,224563,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:01:03+0000 [CowrieTelnetTransport,224563,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T19:01:03+0000 [CowrieTelnetTransport,224563,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:01:03+0000 [CowrieTelnetTransport,224563,52.27.104.84] login attempt: 260
2017-04-12T19:01:03+0000 [CowrieTelnetTransport,224563,52.27.104.84] login return, expect: [user/user]
2017-04-12T19:01:05+0000 [CowrieTelnetTransport,224563,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T19:01:05+0000 [CowrieTelnetTransport,224563,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:01:05+0000 [SSHChannel None (312) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:01:05+0000 [SSHChannel None (312) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 312
2017-04-12T19:01:05+0000 [SSHChannel None (316) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:01:05+0000 [SSHChannel None (316) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:01:05+0000 [SSHChannel None (316) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 316
2017-04-12T19:01:05+0000 [SSHChannel None (317) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:01:05+0000 [SSHChannel None (317) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:01:05+0000 [SSHChannel None (317) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 317
2017-04-12T19:01:05+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:01:05+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 104.44.194.237:25 from localhost:5556
2017-04-12T19:01:05+0000 [SSHChannel None (313) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:01:05+0000 [SSHChannel None (313) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:01:05+0000 [SSHChannel None (313) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 313
2017-04-12T19:01:05+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:01:05+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 207.46.8.199:25 from localhost:5556
2017-04-12T19:01:05+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:26807 (10.8.41.81:2222) [session: b3e285f3]
2017-04-12T19:01:05+0000 [CowrieTelnetTransport,224556,52.27.104.84] Connection lost after 99 seconds
2017-04-12T19:01:06+0000 [CowrieTelnetTransport,224566,92.253.93.137] login attempt: 18
2017-04-12T19:01:06+0000 [CowrieTelnetTransport,224566,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:08+0000 [CowrieTelnetTransport,224566,92.253.93.137] login attempt [root/1234] failed
2017-04-12T19:01:08+0000 [CowrieTelnetTransport,224566,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:08+0000 [HoneyPotSSHTransport,107224,58.218.204.188] Remote SSH version: SSH-2.0-PUTTY
2017-04-12T19:01:08+0000 [HoneyPotSSHTransport,107224,58.218.204.188] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
2017-04-12T19:01:08+0000 [HoneyPotSSHTransport,107224,58.218.204.188] outgoing: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:01:08+0000 [HoneyPotSSHTransport,107224,58.218.204.188] incoming: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:01:09+0000 [SSHChannel None (73) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] remote eof
2017-04-12T19:01:09+0000 [SSHChannel None (73) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] remote close
2017-04-12T19:01:09+0000 [SSHChannel None (73) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] sending close 73
2017-04-12T19:01:09+0000 [HoneyPotSSHTransport,107224,58.218.204.188] NEW KEYS
2017-04-12T19:01:09+0000 [SSHChannel None (318) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:01:09+0000 [CowrieTelnetTransport,224561,52.27.104.84] Connection lost after 77 seconds
2017-04-12T19:01:09+0000 [SSHChannel None (318) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:01:09+0000 [SSHChannel None (318) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 318
2017-04-12T19:01:09+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:01:09+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 104.44.194.235:25 from localhost:5556
2017-04-12T19:01:09+0000 [HoneyPotSSHTransport,107224,58.218.204.188] starting service 'ssh-userauth'
2017-04-12T19:01:09+0000 [CowrieTelnetTransport,224566,92.253.93.137] Connection lost after 17 seconds
2017-04-12T19:01:10+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107224,58.218.204.188] 'root' trying auth 'none'
2017-04-12T19:01:11+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107224,58.218.204.188] 'root' authenticated with 'none'
2017-04-12T19:01:11+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107224,58.218.204.188] starting service 'ssh-connection'
2017-04-12T19:01:11+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 92.253.93.137:48069 (10.8.41.81:2223) [session: TT224567]
2017-04-12T19:01:11+0000 [HoneyPotSSHTransport,107224,58.218.204.188] Got remote error, code 11
	reason: 
2017-04-12T19:01:11+0000 [HoneyPotSSHTransport,107224,58.218.204.188] avatar root logging out
2017-04-12T19:01:11+0000 [HoneyPotSSHTransport,107224,58.218.204.188] connection lost
2017-04-12T19:01:11+0000 [HoneyPotSSHTransport,107224,58.218.204.188] Connection lost after 6 seconds
2017-04-12T19:01:12+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt: 19
2017-04-12T19:01:12+0000 [CowrieTelnetTransport,224567,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:14+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt [root/klv123] failed
2017-04-12T19:01:14+0000 [CowrieTelnetTransport,224567,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:14+0000 [SSHChannel None (319) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:01:14+0000 [SSHChannel None (319) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:01:14+0000 [SSHChannel None (319) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 319
2017-04-12T19:01:14+0000 [CowrieTelnetTransport,224559,164.52.9.62] Connection lost after 96 seconds
2017-04-12T19:01:14+0000 [CowrieTelnetTransport,224554,220.133.39.64] Closing TTY Log: log/tty/20170412-185937-None-224554i.log after 96 seconds
2017-04-12T19:01:14+0000 [CowrieTelnetTransport,224554,220.133.39.64] honeypot terminal protocol connection lost [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly.
	]
2017-04-12T19:01:14+0000 [CowrieTelnetTransport,224554,220.133.39.64] Connection lost after 116 seconds
2017-04-12T19:01:15+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 220.133.39.64:44316 (10.8.41.81:2223) [session: TT224568]
2017-04-12T19:01:15+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt: 20
2017-04-12T19:01:15+0000 [CowrieTelnetTransport,224567,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:18+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt [root/ikwb] failed
2017-04-12T19:01:18+0000 [CowrieTelnetTransport,224567,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:18+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:01:18+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 65.55.92.152:25 from localhost:5556
2017-04-12T19:01:18+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt: 21
2017-04-12T19:01:18+0000 [CowrieTelnetTransport,224567,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:21+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt [root/7ujMko0vizxv] failed
2017-04-12T19:01:21+0000 [CowrieTelnetTransport,224567,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:21+0000 [CowrieTelnetTransport,224568,220.133.39.64] login attempt: 4
2017-04-12T19:01:21+0000 [CowrieTelnetTransport,224568,220.133.39.64] login return, expect: [root/1001chin]
2017-04-12T19:01:23+0000 [CowrieTelnetTransport,224568,220.133.39.64] login attempt [root/win1dows\x00] failed
2017-04-12T19:01:23+0000 [CowrieTelnetTransport,224568,220.133.39.64] Warning: state changed and new state returned
2017-04-12T19:01:26+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt: 22
2017-04-12T19:01:26+0000 [CowrieTelnetTransport,224567,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:28+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt [root/123456] failed
2017-04-12T19:01:28+0000 [CowrieTelnetTransport,224567,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:29+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt: 23
2017-04-12T19:01:29+0000 [CowrieTelnetTransport,224567,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:31+0000 [CowrieTelnetTransport,224567,92.253.93.137] login attempt [root/54321] failed
2017-04-12T19:01:31+0000 [CowrieTelnetTransport,224567,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:31+0000 [CowrieTelnetTransport,224567,92.253.93.137] Connection lost after 20 seconds
2017-04-12T19:01:32+0000 [CowrieTelnetTransport,224568,220.133.39.64] login attempt: 5
2017-04-12T19:01:32+0000 [CowrieTelnetTransport,224568,220.133.39.64] login return, expect: [root/1001chin]
2017-04-12T19:01:34+0000 [CowrieTelnetTransport,224568,220.133.39.64] login attempt [enable\x00/system\x00] failed
2017-04-12T19:01:34+0000 [CowrieTelnetTransport,224568,220.133.39.64] Warning: state changed and new state returned
2017-04-12T19:01:34+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 92.253.93.137:48145 (10.8.41.81:2223) [session: TT224569]
2017-04-12T19:01:34+0000 [CowrieTelnetTransport,224565,52.27.104.84] Connection lost after 61 seconds
2017-04-12T19:01:34+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:51160 (10.8.41.81:2222) [session: eefa45e0]
2017-04-12T19:01:34+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:01:34+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 65.55.37.88:25 from localhost:5556
2017-04-12T19:01:34+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:01:34+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 65.55.92.136:25 from localhost:5556
2017-04-12T19:01:34+0000 [HoneyPotSSHTransport,107225,58.218.204.188] Remote SSH version: SSH-2.0-PUTTY
2017-04-12T19:01:34+0000 [HoneyPotSSHTransport,107225,58.218.204.188] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
2017-04-12T19:01:34+0000 [HoneyPotSSHTransport,107225,58.218.204.188] outgoing: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:01:34+0000 [HoneyPotSSHTransport,107225,58.218.204.188] incoming: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:01:35+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt: 24
2017-04-12T19:01:35+0000 [CowrieTelnetTransport,224569,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:37+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt [admin/1234] failed
2017-04-12T19:01:37+0000 [CowrieTelnetTransport,224569,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:37+0000 [CowrieTelnetTransport,224568,220.133.39.64] login attempt: 6
2017-04-12T19:01:37+0000 [CowrieTelnetTransport,224568,220.133.39.64] login return, expect: [root/1001chin]
2017-04-12T19:01:40+0000 [CowrieTelnetTransport,224568,220.133.39.64] login attempt [shell\x00/sh\x00] failed
2017-04-12T19:01:40+0000 [CowrieTelnetTransport,224568,220.133.39.64] Warning: state changed and new state returned
2017-04-12T19:01:40+0000 [CowrieTelnetTransport,224563,52.27.104.84] Connection lost after 75 seconds
2017-04-12T19:01:40+0000 [HoneyPotSSHTransport,107225,58.218.204.188] connection lost
2017-04-12T19:01:40+0000 [HoneyPotSSHTransport,107225,58.218.204.188] Connection lost after 5 seconds
2017-04-12T19:01:40+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:01:40+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 104.44.194.237:25 from localhost:5556
2017-04-12T19:01:40+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt: 25
2017-04-12T19:01:40+0000 [CowrieTelnetTransport,224569,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:42+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt [root/7ujMko0admin] failed
2017-04-12T19:01:42+0000 [CowrieTelnetTransport,224569,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:43+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt: 26
2017-04-12T19:01:43+0000 [CowrieTelnetTransport,224569,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:45+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt [root/vizxv] failed
2017-04-12T19:01:45+0000 [CowrieTelnetTransport,224569,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:46+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt: 27
2017-04-12T19:01:46+0000 [CowrieTelnetTransport,224569,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:48+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt [888888/888888] failed
2017-04-12T19:01:48+0000 [CowrieTelnetTransport,224569,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:49+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt: 28
2017-04-12T19:01:49+0000 [CowrieTelnetTransport,224569,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:51+0000 [CowrieTelnetTransport,224569,92.253.93.137] login attempt [mother/fucker] failed
2017-04-12T19:01:52+0000 [CowrieTelnetTransport,224569,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:52+0000 [CowrieTelnetTransport,224569,92.253.93.137] Connection lost after 17 seconds
2017-04-12T19:01:52+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 92.253.93.137:48220 (10.8.41.81:2223) [session: TT224570]
2017-04-12T19:01:54+0000 [CowrieTelnetTransport,224570,92.253.93.137] login attempt: 29
2017-04-12T19:01:54+0000 [CowrieTelnetTransport,224570,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:01:57+0000 [CowrieTelnetTransport,224570,92.253.93.137] login attempt [root/admin] failed
2017-04-12T19:01:57+0000 [CowrieTelnetTransport,224570,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:01:57+0000 [SSHChannel None (320) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:01:57+0000 [SSHChannel None (320) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:01:57+0000 [SSHChannel None (320) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 320
2017-04-12T19:01:57+0000 [SSHChannel None (323) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:01:57+0000 [SSHChannel None (323) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:01:57+0000 [SSHChannel None (323) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 323
2017-04-12T19:01:57+0000 [SSHChannel None (321) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:01:57+0000 [SSHChannel None (321) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:01:57+0000 [SSHChannel None (321) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 321
2017-04-12T19:01:57+0000 [CowrieTelnetTransport,224570,92.253.93.137] login attempt: 30
2017-04-12T19:01:57+0000 [CowrieTelnetTransport,224570,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:02:00+0000 [CowrieTelnetTransport,224570,92.253.93.137] login attempt [administrator/1234] failed
2017-04-12T19:02:00+0000 [CowrieTelnetTransport,224570,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:02:00+0000 [SSHChannel None (324) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:02:00+0000 [SSHChannel None (324) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:02:00+0000 [SSHChannel None (324) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 324
2017-04-12T19:02:00+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:58207 (10.8.41.81:2222) [session: 65e68b39]
2017-04-12T19:02:01+0000 [CowrieTelnetTransport,224570,92.253.93.137] login attempt: 31
2017-04-12T19:02:01+0000 [CowrieTelnetTransport,224570,92.253.93.137] login return, expect: [admin/pass]
2017-04-12T19:02:02+0000 [CowrieTelnetTransport,224570,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:02:02+0000 [HoneyPotSSHTransport,107226,58.218.204.188] Remote SSH version: SSH-2.0-PUTTY
2017-04-12T19:02:02+0000 [HoneyPotSSHTransport,107226,58.218.204.188] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
2017-04-12T19:02:02+0000 [HoneyPotSSHTransport,107226,58.218.204.188] outgoing: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:02:02+0000 [HoneyPotSSHTransport,107226,58.218.204.188] incoming: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:02:02+0000 [HoneyPotSSHTransport,107226,58.218.204.188] NEW KEYS
2017-04-12T19:02:02+0000 [CowrieTelnetTransport,224570,92.253.93.137] first time for 92.253.93.137, need: 1
2017-04-12T19:02:02+0000 [CowrieTelnetTransport,224570,92.253.93.137] login attempt: 1
2017-04-12T19:02:02+0000 [CowrieTelnetTransport,224570,92.253.93.137] login attempt [admin/admin1234] succeeded
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] Opening TTY Log: log/tty/20170412-190204-None-224570i.log
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] Warning: state changed and new state returned
2017-04-12T19:02:04+0000 [HoneyPotSSHTransport,107226,58.218.204.188] starting service 'ssh-userauth'
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] CMD: enable
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: enable 
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] Reading txtcmd from "txtcmds/bin/enable"
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] CMD: shell
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command not found: shell
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] CMD: sh
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: sh 
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] CMD: cat /proc/mounts; /bin/busybox JCDNZ
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: cat /proc/mounts
2017-04-12T19:02:04+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: /bin/busybox JCDNZ
2017-04-12T19:02:04+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107226,58.218.204.188] 'root' trying auth 'none'
2017-04-12T19:02:06+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107226,58.218.204.188] 'root' authenticated with 'none'
2017-04-12T19:02:06+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107226,58.218.204.188] starting service 'ssh-connection'
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] CMD: cd /dev/shm; (cat .s || cp /bin/echo .s); /bin/busybox JCDNZ
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: cd /dev/shm
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: cat .s
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: cp /bin/echo .s
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: /bin/busybox JCDNZ
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] CMD: nc; wget; /bin/busybox JCDNZ
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command not found: nc
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: wget 
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: /bin/busybox JCDNZ
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] CMD: (dd bs=52 count=1 if=.s || cat .s)
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command not found: dd bs=52 count=1 if=.s
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: cat /dev/shm/.s
2017-04-12T19:02:06+0000 [HoneyPotSSHTransport,107226,58.218.204.188] Got remote error, code 11
	reason: 
2017-04-12T19:02:06+0000 [HoneyPotSSHTransport,107226,58.218.204.188] avatar root logging out
2017-04-12T19:02:06+0000 [HoneyPotSSHTransport,107226,58.218.204.188] connection lost
2017-04-12T19:02:06+0000 [HoneyPotSSHTransport,107226,58.218.204.188] Connection lost after 6 seconds
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] CMD: /bin/busybox JCDNZ
2017-04-12T19:02:06+0000 [CowrieTelnetTransport,224570,92.253.93.137] Command found: /bin/busybox JCDNZ
2017-04-12T19:02:07+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] got channel 'direct-tcpip' request
2017-04-12T19:02:07+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] direct-tcp connection request to 104.81.240.34:443 from localhost:5556
2017-04-12T19:02:07+0000 [SSHChannel None (65) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] direct-tcp forward to 104.81.240.34:443 with data '\x16\x03\x01\x00\x85\x01\x00\x00\x81\x03\x01X\xeey\x97\xfa\x1a\x1b\x84T\x8c^\xc3\xa3\xf0\xbe\xe5j\x10\xec\xf0\xf1\xde\xaaMx\x883UrD\xa3=\x00\x00\x18\xc0\x14\xc0\x13\x005\x00/\xc0\n\xc0\t\x008\x002\x00\n\x00\x13\x00\x05\x00\x04\x01\x00\x00@\x00\x00\x00\x1f\x00\x1d\x00\x00\x1aauth.np.ac.playstation.net\x00\n\x00\x06\x00\x04\x00\x17\x00\x18\x00\x0b\x00\x02\x01\x00\x00#\x00\x00\x00\x17\x00\x00\xff\x01\x00\x01\x00'
2017-04-12T19:02:07+0000 [SSHChannel None (65) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] failed to connect: Connection refused
2017-04-12T19:02:07+0000 [SSHChannel None (65) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] sending close 65
2017-04-12T19:02:08+0000 [SSHChannel None (322) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:02:08+0000 [SSHChannel None (322) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:02:08+0000 [SSHChannel None (322) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 322
2017-04-12T19:02:09+0000 [SSHChannel None (328) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:02:11+0000 [SSHChannel None (328) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:02:11+0000 [SSHChannel None (328) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 328
2017-04-12T19:02:13+0000 [CowrieTelnetTransport,224568,220.133.39.64] Connection lost after 58 seconds
2017-04-12T19:02:14+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 220.133.39.64:44492 (10.8.41.81:2223) [session: TT224571]
2017-04-12T19:02:14+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:02:14+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 65.55.92.184:25 from localhost:5556
2017-04-12T19:02:15+0000 [CowrieTelnetTransport,224571,220.133.39.64] first time for 220.133.39.64, need: 1
2017-04-12T19:02:15+0000 [CowrieTelnetTransport,224571,220.133.39.64] login attempt: 1
2017-04-12T19:02:15+0000 [CowrieTelnetTransport,224571,220.133.39.64] login attempt [root/1001chin\x00] succeeded
2017-04-12T19:02:16+0000 [CowrieTelnetTransport,224571,220.133.39.64] Opening TTY Log: log/tty/20170412-190216-None-224571i.log
2017-04-12T19:02:16+0000 [CowrieTelnetTransport,224571,220.133.39.64] Warning: state changed and new state returned
2017-04-12T19:02:16+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 189.44.177.155:49583 (10.8.41.81:2223) [session: TT224572]
2017-04-12T19:02:17+0000 [CowrieTelnetTransport,224571,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:02:17+0000 [CowrieTelnetTransport,224571,220.133.39.64] CMD: enable
2017-04-12T19:02:17+0000 [CowrieTelnetTransport,224571,220.133.39.64] Command found: enable 
2017-04-12T19:02:17+0000 [CowrieTelnetTransport,224571,220.133.39.64] Reading txtcmd from "txtcmds/bin/enable"
2017-04-12T19:02:17+0000 [CowrieTelnetTransport,224571,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:02:18+0000 [CowrieTelnetTransport,224572,189.44.177.155] first time for 189.44.177.155, need: 1
2017-04-12T19:02:18+0000 [CowrieTelnetTransport,224572,189.44.177.155] login attempt: 1
2017-04-12T19:02:18+0000 [CowrieTelnetTransport,224572,189.44.177.155] login attempt [root/888888] succeeded
2017-04-12T19:02:19+0000 [CowrieTelnetTransport,224572,189.44.177.155] Opening TTY Log: log/tty/20170412-190219-None-224572i.log
2017-04-12T19:02:19+0000 [CowrieTelnetTransport,224572,189.44.177.155] Warning: state changed and new state returned
2017-04-12T19:02:19+0000 [CowrieTelnetTransport,224571,220.133.39.64] CMD: system
2017-04-12T19:02:19+0000 [CowrieTelnetTransport,224571,220.133.39.64] Command not found: system
2017-04-12T19:02:19+0000 [CowrieTelnetTransport,224571,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:02:19+0000 [CowrieTelnetTransport,224571,220.133.39.64] CMD: shell
2017-04-12T19:02:19+0000 [CowrieTelnetTransport,224571,220.133.39.64] Command not found: shell
2017-04-12T19:02:19+0000 [CowrieTelnetTransport,224571,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224571,220.133.39.64] CMD: sh
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224571,220.133.39.64] Command found: sh 
2017-04-12T19:02:20+0000 [SSHChannel None (325) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224571,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224571,220.133.39.64] CMD: fgrep XDVR /mnt/mtd/dep2.sh
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224571,220.133.39.64] Command found: fgrep XDVR /mnt/mtd/dep2.sh
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224572,189.44.177.155] CMD: enable
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: enable 
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224572,189.44.177.155] Reading txtcmd from "txtcmds/bin/enable"
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224572,189.44.177.155] CMD: shell
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command not found: shell
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224572,189.44.177.155] CMD: sh
2017-04-12T19:02:20+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: sh 
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] CMD: cat /proc/mounts; /bin/busybox XDXBX
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: cat /proc/mounts
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: /bin/busybox XDXBX
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] CMD: cd /dev/shm; (cat .s || cp /bin/echo .s); /bin/busybox XDXBX
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: cd /dev/shm
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: cat .s
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: cp /bin/echo .s
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: /bin/busybox XDXBX
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] CMD: nc; wget; /bin/busybox XDXBX
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command not found: nc
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: wget 
2017-04-12T19:02:21+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: /bin/busybox XDXBX
2017-04-12T19:02:22+0000 [CowrieTelnetTransport,224572,189.44.177.155] CMD: (dd bs=52 count=1 if=.s || cat .s)
2017-04-12T19:02:22+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command not found: dd bs=52 count=1 if=.s
2017-04-12T19:02:22+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: cat /dev/shm/.s
2017-04-12T19:02:22+0000 [SSHChannel None (325) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:02:22+0000 [SSHChannel None (325) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 325
2017-04-12T19:02:22+0000 [SSHChannel None (327) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:02:22+0000 [SSHChannel None (327) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:02:22+0000 [SSHChannel None (327) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 327
2017-04-12T19:02:22+0000 [SSHChannel None (330) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:02:22+0000 [SSHChannel None (330) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:02:22+0000 [SSHChannel None (330) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 330
2017-04-12T19:02:22+0000 [CowrieTelnetTransport,224572,189.44.177.155] CMD: /bin/busybox XDXBX
2017-04-12T19:02:22+0000 [CowrieTelnetTransport,224572,189.44.177.155] Command found: /bin/busybox XDXBX
2017-04-12T19:02:28+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:23311 (10.8.41.81:2222) [session: bb5b39a4]
2017-04-12T19:02:29+0000 [HoneyPotSSHTransport,107227,58.218.204.188] Remote SSH version: SSH-2.0-PUTTY
2017-04-12T19:02:29+0000 [HoneyPotSSHTransport,107227,58.218.204.188] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
2017-04-12T19:02:29+0000 [HoneyPotSSHTransport,107227,58.218.204.188] outgoing: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:02:29+0000 [HoneyPotSSHTransport,107227,58.218.204.188] incoming: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:02:30+0000 [HoneyPotSSHTransport,107227,58.218.204.188] NEW KEYS
2017-04-12T19:02:30+0000 [HoneyPotSSHTransport,107227,58.218.204.188] starting service 'ssh-userauth'
2017-04-12T19:02:30+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107227,58.218.204.188] 'root' trying auth 'none'
2017-04-12T19:02:32+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107227,58.218.204.188] 'root' authenticated with 'none'
2017-04-12T19:02:32+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107227,58.218.204.188] starting service 'ssh-connection'
2017-04-12T19:02:32+0000 [SSHChannel None (333) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:02:32+0000 [SSHChannel None (333) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:02:32+0000 [SSHChannel None (333) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 333
2017-04-12T19:02:32+0000 [HoneyPotSSHTransport,107227,58.218.204.188] Got remote error, code 11
	reason: 
2017-04-12T19:02:32+0000 [HoneyPotSSHTransport,107227,58.218.204.188] avatar root logging out
2017-04-12T19:02:32+0000 [HoneyPotSSHTransport,107227,58.218.204.188] connection lost
2017-04-12T19:02:32+0000 [HoneyPotSSHTransport,107227,58.218.204.188] Connection lost after 3 seconds
2017-04-12T19:02:47+0000 [SSHChannel None (332) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:02:49+0000 [SSHChannel None (332) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:02:49+0000 [SSHChannel None (332) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 332
2017-04-12T19:02:50+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:02:50+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 144.160.235.143:25 from localhost:5556
2017-04-12T19:02:51+0000 [CowrieTelnetTransport,224571,220.133.39.64] Closing TTY Log: log/tty/20170412-190216-None-224571i.log after 34 seconds
2017-04-12T19:02:51+0000 [CowrieTelnetTransport,224571,220.133.39.64] honeypot terminal protocol connection lost [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly.
	]
2017-04-12T19:02:51+0000 [CowrieTelnetTransport,224571,220.133.39.64] Connection lost after 37 seconds
2017-04-12T19:02:52+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 220.133.39.64:44604 (10.8.41.81:2223) [session: TT224573]
2017-04-12T19:02:53+0000 [CowrieTelnetTransport,224573,220.133.39.64] login attempt: 2
2017-04-12T19:02:53+0000 [CowrieTelnetTransport,224573,220.133.39.64] login return, expect: [root/1001chin]
2017-04-12T19:02:53+0000 [CowrieTelnetTransport,224573,220.133.39.64] login attempt [root/win1dows\x00] failed
2017-04-12T19:02:53+0000 [CowrieTelnetTransport,224573,220.133.39.64] Warning: state changed and new state returned
2017-04-12T19:02:54+0000 [CowrieTelnetTransport,224573,220.133.39.64] login attempt: 3
2017-04-12T19:02:54+0000 [CowrieTelnetTransport,224573,220.133.39.64] login return, expect: [root/1001chin]
2017-04-12T19:02:54+0000 [CowrieTelnetTransport,224573,220.133.39.64] login attempt [enable\x00/system\x00] failed
2017-04-12T19:02:54+0000 [CowrieTelnetTransport,224573,220.133.39.64] Warning: state changed and new state returned
2017-04-12T19:02:55+0000 [CowrieTelnetTransport,224573,220.133.39.64] login attempt: 4
2017-04-12T19:02:55+0000 [CowrieTelnetTransport,224573,220.133.39.64] login return, expect: [root/1001chin]
2017-04-12T19:02:55+0000 [CowrieTelnetTransport,224573,220.133.39.64] login attempt [shell\x00/sh\x00] failed
2017-04-12T19:02:55+0000 [CowrieTelnetTransport,224573,220.133.39.64] Warning: state changed and new state returned
2017-04-12T19:02:57+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:41696 (10.8.41.81:2222) [session: 5894b1de]
2017-04-12T19:02:57+0000 [HoneyPotSSHTransport,107228,58.218.204.188] Remote SSH version: SSH-2.0-PUTTY
2017-04-12T19:02:57+0000 [HoneyPotSSHTransport,107228,58.218.204.188] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
2017-04-12T19:02:57+0000 [HoneyPotSSHTransport,107228,58.218.204.188] outgoing: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:02:57+0000 [HoneyPotSSHTransport,107228,58.218.204.188] incoming: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:02:58+0000 [HoneyPotSSHTransport,107228,58.218.204.188] NEW KEYS
2017-04-12T19:02:58+0000 [HoneyPotSSHTransport,107228,58.218.204.188] starting service 'ssh-userauth'
2017-04-12T19:02:59+0000 [SSHChannel None (334) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:02:59+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107228,58.218.204.188] 'root' trying auth 'none'
2017-04-12T19:03:01+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107228,58.218.204.188] 'root' authenticated with 'none'
2017-04-12T19:03:01+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107228,58.218.204.188] starting service 'ssh-connection'
2017-04-12T19:03:01+0000 [SSHChannel None (334) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:03:01+0000 [SSHChannel None (334) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 334
2017-04-12T19:03:01+0000 [SSHChannel None (335) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:03:01+0000 [SSHChannel None (335) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:03:01+0000 [SSHChannel None (335) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 335
2017-04-12T19:03:01+0000 [HoneyPotSSHTransport,107228,58.218.204.188] Got remote error, code 11
	reason: 
2017-04-12T19:03:01+0000 [HoneyPotSSHTransport,107228,58.218.204.188] avatar root logging out
2017-04-12T19:03:01+0000 [HoneyPotSSHTransport,107228,58.218.204.188] connection lost
2017-04-12T19:03:01+0000 [HoneyPotSSHTransport,107228,58.218.204.188] Connection lost after 4 seconds
2017-04-12T19:03:09+0000 [SSHChannel None (336) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:03:11+0000 [SSHChannel None (336) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:03:11+0000 [SSHChannel None (336) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 336
2017-04-12T19:03:14+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] got channel 'direct-tcpip' request
2017-04-12T19:03:14+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] direct-tcp connection request to 98.138.112.38:25 from localhost:5556
2017-04-12T19:03:14+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:34394 (10.8.41.81:2223) [session: TT224574]
2017-04-12T19:03:15+0000 [SSHChannel None (329) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:03:19+0000 [SSHChannel None (329) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:03:19+0000 [SSHChannel None (329) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 329
2017-04-12T19:03:19+0000 [SSHChannel None (337) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:03:19+0000 [SSHChannel None (337) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:03:19+0000 [SSHChannel None (337) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 337
2017-04-12T19:03:19+0000 [CowrieTelnetTransport,224574,52.27.104.84] first time for 52.27.104.84, need: 1
2017-04-12T19:03:19+0000 [CowrieTelnetTransport,224574,52.27.104.84] login attempt: 1
2017-04-12T19:03:19+0000 [CowrieTelnetTransport,224574,52.27.104.84] login attempt [root/admin] succeeded
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] Opening TTY Log: log/tty/20170412-190323-None-224574i.log
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:23+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:46972 (10.8.41.81:2223) [session: TT224575]
2017-04-12T19:03:23+0000 [SSHChannel None (340) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:03:23+0000 [SSHChannel None (340) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:03:23+0000 [SSHChannel None (340) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 340
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: enable
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: enable 
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] Reading txtcmd from "txtcmds/bin/enable"
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: shell
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command not found: shell
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: sh
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: sh 
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox ECCHI
2017-04-12T19:03:23+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox ECCHI
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox ps; /bin/busybox ECCHI
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox ps
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: ps
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox ECCHI
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox cat /proc/mounts; /bin/busybox ECCHI
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /proc/mounts
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /proc/mounts
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox ECCHI
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon; /bin/busybox cat /.nippon; /bin/busybox rm /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys' > /sys/.nippon; /bin/busybox cat /sys/.nippon; /bin/busybox rm /sys/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys' > /sys/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/sys'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /sys/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /sys/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /sys/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /sys/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc' > /proc/.nippon; /bin/busybox cat /proc/.nippon; /bin/busybox rm /proc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc' > /proc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/proc'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /proc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /proc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /proc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon; /bin/busybox cat /dev/.nippon; /bin/busybox rm /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/dev'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/pts' > /dev/pts/.nippon; /bin/busybox cat /dev/pts/.nippon; /bin/busybox rm /dev/pts/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/pts' > /dev/pts/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/dev/pts'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /dev/pts/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /dev/pts/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /dev/pts/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/pts/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run' > /run/.nippon; /bin/busybox cat /run/.nippon; /bin/busybox rm /run/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run' > /run/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/run'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /run/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /run/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /run/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /run/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon; /bin/busybox cat /.nippon; /bin/busybox rm /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69' > /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/shm' > /dev/shm/.nippon; /bin/busybox cat /dev/shm/.nippon; /bin/busybox rm /dev/shm/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev/shm' > /dev/shm/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/dev/shm'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /dev/shm/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /dev/shm/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /dev/shm/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/shm/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/lock' > /run/lock/.nippon; /bin/busybox cat /run/lock/.nippon; /bin/busybox rm /run/lock/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/run/lock' > /run/lock/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/run/lock'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /run/lock/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /run/lock/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /run/lock/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /run/lock/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/fuse/connections' > /sys/fs/fuse/connections/.nippon; /bin/busybox cat /sys/fs/fuse/connections/.nippon; /bin/busybox rm /sys/fs/fuse/connections/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/sys/fs/fuse/connections' > /sys/fs/fuse/connections/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /sys/fs/fuse/connections/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /sys/fs/fuse/connections/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /sys/fs/fuse/connections/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /sys/fs/fuse/connections/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/boot' > /boot/.nippon; /bin/busybox cat /boot/.nippon; /bin/busybox rm /boot/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/boot' > /boot/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/boot'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /boot/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /boot/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /boot/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /boot/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/home' > /home/.nippon; /bin/busybox cat /home/.nippon; /bin/busybox rm /home/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/home' > /home/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/home'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /home/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /home/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /home/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /home/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon; /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc' > /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/proc/sys/fs/binfmt_misc'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/sys/fs/binfmt_misc/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon; /bin/busybox cat /dev/.nippon; /bin/busybox rm /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox echo -e '\x6b\x61\x6d\x69/dev' > /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: echo -e '\x6b\x61\x6d\x69/dev'
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox rm /dev/.nippon
2017-04-12T19:03:24+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/.nippon
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox ECCHI
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox ECCHI
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /.t; rm /.sh; rm /.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /sys/.t; rm /sys/.sh; rm /sys/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /sys/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /sys/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /sys/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /proc/.t; rm /proc/.sh; rm /proc/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /dev/.t; rm /dev/.sh; rm /dev/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /dev/pts/.t; rm /dev/pts/.sh; rm /dev/pts/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/pts/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/pts/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/pts/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /run/.t; rm /run/.sh; rm /run/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /run/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /run/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /run/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /.t; rm /.sh; rm /.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /dev/shm/.t; rm /dev/shm/.sh; rm /dev/shm/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/shm/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/shm/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/shm/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /run/lock/.t; rm /run/lock/.sh; rm /run/lock/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /run/lock/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /run/lock/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /run/lock/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /proc/sys/fs/binfmt_misc/.t; rm /proc/sys/fs/binfmt_misc/.sh; rm /proc/sys/fs/binfmt_misc/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/sys/fs/binfmt_misc/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/sys/fs/binfmt_misc/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/sys/fs/binfmt_misc/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /boot/.t; rm /boot/.sh; rm /boot/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /boot/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /boot/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /boot/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /home/.t; rm /home/.sh; rm /home/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /home/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /home/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /home/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /proc/sys/fs/binfmt_misc/.t; rm /proc/sys/fs/binfmt_misc/.sh; rm /proc/sys/fs/binfmt_misc/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/sys/fs/binfmt_misc/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/sys/fs/binfmt_misc/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /proc/sys/fs/binfmt_misc/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: rm /dev/.t; rm /dev/.sh; rm /dev/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/.t
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/.sh
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: rm /dev/.human
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: cd /
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cd /
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox cp /bin/echo dvrHelper; >dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox ECCHI
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cp /bin/echo dvrHelper
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cp /bin/echo dvrHelper
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: > /dvrHelper
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox chmod 777 /dvrHelper
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: chmod 777 /dvrHelper
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox ECCHI
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox cat /bin/echo
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox cat /bin/echo
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: cat /bin/echo
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] CMD: /bin/busybox ECCHI
2017-04-12T19:03:25+0000 [CowrieTelnetTransport,224574,52.27.104.84] Command found: /bin/busybox ECCHI
2017-04-12T19:03:26+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:11268 (10.8.41.81:2222) [session: 279d07c5]
2017-04-12T19:03:26+0000 [CowrieTelnetTransport,224573,220.133.39.64] Connection lost after 34 seconds
2017-04-12T19:03:27+0000 [HoneyPotSSHTransport,107229,58.218.204.188] Remote SSH version: SSH-2.0-PUTTY
2017-04-12T19:03:27+0000 [HoneyPotSSHTransport,107229,58.218.204.188] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
2017-04-12T19:03:27+0000 [HoneyPotSSHTransport,107229,58.218.204.188] outgoing: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:03:27+0000 [HoneyPotSSHTransport,107229,58.218.204.188] incoming: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:03:27+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 220.133.39.64:44667 (10.8.41.81:2223) [session: TT224576]
2017-04-12T19:03:27+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] got channel 'direct-tcpip' request
2017-04-12T19:03:27+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] direct-tcp connection request to 207.46.163.42:25 from localhost:5556
2017-04-12T19:03:27+0000 [HoneyPotSSHTransport,107229,58.218.204.188] NEW KEYS
2017-04-12T19:03:27+0000 [CowrieTelnetTransport,224575,52.27.104.84] login attempt: 2
2017-04-12T19:03:27+0000 [CowrieTelnetTransport,224575,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:03:27+0000 [CowrieTelnetTransport,224575,52.27.104.84] login attempt [root/juantech] failed
2017-04-12T19:03:27+0000 [CowrieTelnetTransport,224575,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:28+0000 [HoneyPotSSHTransport,107229,58.218.204.188] starting service 'ssh-userauth'
2017-04-12T19:03:28+0000 [CowrieTelnetTransport,224575,52.27.104.84] login attempt: 3
2017-04-12T19:03:28+0000 [CowrieTelnetTransport,224575,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:03:28+0000 [CowrieTelnetTransport,224575,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T19:03:28+0000 [CowrieTelnetTransport,224575,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:28+0000 [CowrieTelnetTransport,224576,220.133.39.64] login attempt: 5
2017-04-12T19:03:28+0000 [CowrieTelnetTransport,224576,220.133.39.64] login return, expect: [root/1001chin]
2017-04-12T19:03:28+0000 [CowrieTelnetTransport,224576,220.133.39.64] login attempt [root/1001chin\x00] succeeded
2017-04-12T19:03:30+0000 [CowrieTelnetTransport,224576,220.133.39.64] Opening TTY Log: log/tty/20170412-190330-None-224576i.log
2017-04-12T19:03:30+0000 [CowrieTelnetTransport,224576,220.133.39.64] Warning: state changed and new state returned
2017-04-12T19:03:30+0000 [CowrieTelnetTransport,224575,52.27.104.84] login attempt: 4
2017-04-12T19:03:30+0000 [CowrieTelnetTransport,224575,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:03:30+0000 [CowrieTelnetTransport,224575,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T19:03:30+0000 [CowrieTelnetTransport,224575,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:30+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107229,58.218.204.188] 'root' trying auth 'none'
2017-04-12T19:03:31+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107229,58.218.204.188] 'root' authenticated with 'none'
2017-04-12T19:03:31+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107229,58.218.204.188] starting service 'ssh-connection'
2017-04-12T19:03:31+0000 [CowrieTelnetTransport,224576,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:03:31+0000 [CowrieTelnetTransport,224576,220.133.39.64] CMD: enable
2017-04-12T19:03:31+0000 [CowrieTelnetTransport,224576,220.133.39.64] Command found: enable 
2017-04-12T19:03:31+0000 [CowrieTelnetTransport,224576,220.133.39.64] Reading txtcmd from "txtcmds/bin/enable"
2017-04-12T19:03:31+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:52606 (10.8.41.81:2223) [session: TT224577]
2017-04-12T19:03:31+0000 [CowrieTelnetTransport,224576,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:03:32+0000 [HoneyPotSSHTransport,107229,58.218.204.188] Got remote error, code 11
	reason: 
2017-04-12T19:03:32+0000 [HoneyPotSSHTransport,107229,58.218.204.188] avatar root logging out
2017-04-12T19:03:32+0000 [HoneyPotSSHTransport,107229,58.218.204.188] connection lost
2017-04-12T19:03:32+0000 [HoneyPotSSHTransport,107229,58.218.204.188] Connection lost after 5 seconds
2017-04-12T19:03:32+0000 [CowrieTelnetTransport,224576,220.133.39.64] CMD: system
2017-04-12T19:03:32+0000 [CowrieTelnetTransport,224576,220.133.39.64] Command not found: system
2017-04-12T19:03:32+0000 [CowrieTelnetTransport,224576,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:03:32+0000 [CowrieTelnetTransport,224576,220.133.39.64] CMD: shell
2017-04-12T19:03:32+0000 [CowrieTelnetTransport,224576,220.133.39.64] Command not found: shell
2017-04-12T19:03:32+0000 [CowrieTelnetTransport,224576,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:03:32+0000 [CowrieTelnetTransport,224576,220.133.39.64] CMD: sh
2017-04-12T19:03:32+0000 [CowrieTelnetTransport,224576,220.133.39.64] Command found: sh 
2017-04-12T19:03:32+0000 [SSHChannel None (339) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:03:33+0000 [CowrieTelnetTransport,224576,220.133.39.64] Received unhandled keyID: '\x00'
2017-04-12T19:03:33+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:45398 (10.8.41.81:2223) [session: TT224578]
2017-04-12T19:03:33+0000 [CowrieTelnetTransport,224576,220.133.39.64] CMD: fgrep XDVR /mnt/mtd/dep2.sh
2017-04-12T19:03:33+0000 [CowrieTelnetTransport,224576,220.133.39.64] Command found: fgrep XDVR /mnt/mtd/dep2.sh
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] login attempt: 5
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] login attempt [admin/123456] failed
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] login attempt: 6
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] login attempt: 7
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T19:03:37+0000 [CowrieTelnetTransport,224577,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:37+0000 [SSHChannel None (339) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:03:37+0000 [SSHChannel None (339) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 339
2017-04-12T19:03:37+0000 [SSHChannel None (338) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote eof
2017-04-12T19:03:37+0000 [SSHChannel None (338) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] remote close
2017-04-12T19:03:37+0000 [SSHChannel None (338) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107009,91.195.103.210] sending close 338
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] login attempt: 8
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] login attempt [admin/password] failed
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] login attempt: 9
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] login attempt [enable/shell] failed
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] login attempt: 10
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] login attempt [sh//bin/busybox ECCHI] failed
2017-04-12T19:03:38+0000 [CowrieTelnetTransport,224578,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:03:39+0000 [SSHChannel None (74) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] remote eof
2017-04-12T19:03:39+0000 [SSHChannel None (74) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] remote close
2017-04-12T19:03:39+0000 [SSHChannel None (74) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] sending close 74
2017-04-12T19:03:39+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] got channel 'direct-tcpip' request
2017-04-12T19:03:39+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107008,91.195.103.197] direct-tcp connection request to 98.138.112.38:25 from localhost:5556
2017-04-12T19:03:47+0000 [CowrieTelnetTransport,224570,92.253.93.137] Closing TTY Log: log/tty/20170412-190204-None-224570i.log after 102 seconds
2017-04-12T19:03:47+0000 [CowrieTelnetTransport,224570,92.253.93.137] honeypot terminal protocol connection lost [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly.
	]
2017-04-12T19:03:47+0000 [CowrieTelnetTransport,224570,92.253.93.137] Connection lost after 115 seconds
2017-04-12T19:03:55+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 58.218.204.188:36279 (10.8.41.81:2222) [session: 54cf1f31]
2017-04-12T19:03:55+0000 [HoneyPotSSHTransport,107230,58.218.204.188] Remote SSH version: SSH-2.0-PUTTY
2017-04-12T19:03:55+0000 [HoneyPotSSHTransport,107230,58.218.204.188] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
2017-04-12T19:03:55+0000 [HoneyPotSSHTransport,107230,58.218.204.188] outgoing: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:03:55+0000 [HoneyPotSSHTransport,107230,58.218.204.188] incoming: 'aes128-ctr' 'hmac-sha1' 'none'
2017-04-12T19:03:56+0000 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 52.27.104.84:42250 (10.8.41.81:2223) [session: TT224579]
2017-04-12T19:03:56+0000 [HoneyPotSSHTransport,107230,58.218.204.188] NEW KEYS
2017-04-12T19:03:56+0000 [HoneyPotSSHTransport,107230,58.218.204.188] starting service 'ssh-userauth'
2017-04-12T19:03:57+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107230,58.218.204.188] 'root' trying auth 'none'
2017-04-12T19:03:58+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107230,58.218.204.188] 'root' authenticated with 'none'
2017-04-12T19:03:58+0000 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,107230,58.218.204.188] starting service 'ssh-connection'
2017-04-12T19:03:59+0000 [HoneyPotSSHTransport,107230,58.218.204.188] Got remote error, code 11
	reason: 
2017-04-12T19:03:59+0000 [HoneyPotSSHTransport,107230,58.218.204.188] avatar root logging out
2017-04-12T19:03:59+0000 [HoneyPotSSHTransport,107230,58.218.204.188] connection lost
2017-04-12T19:03:59+0000 [HoneyPotSSHTransport,107230,58.218.204.188] Connection lost after 3 seconds
2017-04-12T19:04:00+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] got channel 'direct-tcpip' request
2017-04-12T19:04:00+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] direct-tcp connection request to 184.73.209.98:443 from localhost:5556
2017-04-12T19:04:00+0000 [SSHChannel None (66) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] direct-tcp forward to 184.73.209.98:443 with data '\x16\x03\x01\x00\xaa\x01\x00\x00\xa6\x03\x01X\xeez\x08=4\xd8\xd0\x05\x9c\xad\xb6L\xcf\xe3\xc6h\x03\x96!>\xf6\xf2\t2\x81b\xd8\x89u\x86E \x82\xcf}-\x9c;\xad(\xd4\t\x87x\x1b\xe3\x06S\x90\x1e\x9cc\xe3B\xecP\x89-\xe9\xfc\x83W\x1f\xac\x00\x18\xc0\x14\xc0\x13\x005\x00/\xc0\n\xc0\t\x008\x002\x00\n\x00\x13\x00\x05\x00\x04\x01\x00\x00E\x00\x00\x00$\x00"\x00\x00\x1fru.socialclub.rockstargames.com\x00\n\x00\x06\x00\x04\x00\x17\x00\x18\x00\x0b\x00\x02\x01\x00\x00#\x00\x00\x00\x17\x00\x00\xff\x01\x00\x01\x00'
2017-04-12T19:04:00+0000 [SSHChannel None (66) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] failed to connect: Connection refused
2017-04-12T19:04:00+0000 [SSHChannel None (66) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] sending close 66
2017-04-12T19:04:01+0000 [CowrieTelnetTransport,224579,52.27.104.84] login attempt: 11
2017-04-12T19:04:01+0000 [CowrieTelnetTransport,224579,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:04:01+0000 [CowrieTelnetTransport,224579,52.27.104.84] login attempt [root/xmhdipc] failed
2017-04-12T19:04:01+0000 [CowrieTelnetTransport,224579,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:04:01+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] got channel 'direct-tcpip' request
2017-04-12T19:04:01+0000 [SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] direct-tcp connection request to 184.73.209.98:443 from localhost:5556
2017-04-12T19:04:01+0000 [CowrieTelnetTransport,224579,52.27.104.84] login attempt: 12
2017-04-12T19:04:01+0000 [CowrieTelnetTransport,224579,52.27.104.84] login return, expect: [root/admin]
2017-04-12T19:04:01+0000 [CowrieTelnetTransport,224579,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:04:02+0000 [CowrieTelnetTransport,224579,52.27.104.84] first time for 52.27.104.84, need: 1
2017-04-12T19:04:02+0000 [CowrieTelnetTransport,224579,52.27.104.84] login attempt: 1
2017-04-12T19:04:02+0000 [CowrieTelnetTransport,224579,52.27.104.84] Warning: state changed and new state returned
2017-04-12T19:04:02+0000 [CowrieTelnetTransport,224575,52.27.104.84] Connection lost after 39 seconds
2017-04-12T19:04:02+0000 [SSHChannel None (67) on SSHService 'ssh-connection' on HoneyPotSSHTransport,107037,91.195.103.220] direct-tcp forward to 184.73.209.98:443 with data '\x16\x03\x01\x00\xaa\x01\x00\x00\xa6\x03\x01X\xeez\n\r-R^\xf2017-04-13T16:02:01+0000 [CowrieTelnetTransport,231066,52.27.104.84] first time for 52.27.104.84, need: 1
2017-04-13T16:02:01+0000 [CowrieTelnetTransport,231066,52.27.104.84] login attempt: 1
2017-04-13T16:02:01+0000 [CowrieTelnetTransport,231066,52.27.104.84] login attempt [admin/password] succeeded
2017-04-13T16:02:01+0000 [twisted.internet.defer#critical] Unhandled error in Deferred:
2017-04-13T16:02:01+0000 [twisted.internet.defer#critical] 
	Traceback (most recent call last):
	  File "/home/cowrie/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/internet/base.py", line 1252, in mainLoop
	    self.runUntilCurrent()
	  File "/home/cowrie/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/internet/base.py", line 878, in runUntilCurrent
	    call.func(*call.args, **call.kw)
	  File "/home/cowrie/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/internet/defer.py", line 459, in callback
	    self._startRunCallbacks(result)
	  File "/home/cowrie/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/internet/defer.py", line 567, in _startRunCallbacks
	    self._runCallbacks()
	--- <exception caught here> ---
	  File "/home/cowrie/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/internet/defer.py", line 653, in _runCallbacks
	    current.result = callback(current.result, *args, **kw)
	  File "/home/cowrie/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/conch/ssh/userauth.py", line 251, in _ebBadAuth
	    NS(b','.join(self.supportedAuthentications)) + b'\x00')
	  File "/home/cowrie/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/conch/ssh/transport.py", line 637, in sendPacket
	    self.transport.write(encPacket)
	exceptions.AttributeError: 'NoneType' object has no attribute 'write'