Cowrie honeypot: username: "GET / HTTP/1.0" password: "Host: 127.0.0.1"

[MusicGR]

I noticed that inCowrie tool in the username/andpasword tables i get: username: "GET / HTTP/1.0" password: "Host: 127.0.0.1"

I used "Discover" to see what happens and got this:

So i wonder, is this an HTTP request/attack and accidentally or not, went to port 22 ?

I managed to reproduce this behaviour by run:

ssh "GET / HTTP/1.0"@<x.x.x.x (my_IP)> -p 22

and using this password: Host: 127.0.0.1

So the question is:

Is the above a misinterpreted from Cowrie http attack to port 22 or simply someone used the above credentials to ssh?

Thanks in advance