139.19.117.130
- Sensor
- hp-use-01
- Source
- cowrie
- Status
- failed
- Event time
- Received
Triage failed — no verdict was produced.
Tool trace
No tool calls were made.
Raw session JSON
{
"events": [
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "139.19.117.130",
"eventid": "cowrie.session.connect",
"message": "New connection: 139.19.117.130:35516 (172.18.0.2:2222) [session: fcb3b61f32d8]",
"outfile": null,
"session": "fcb3b61f32d8",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 35516,
"username": null,
"timestamp": "2026-10-29T07:34:11.890898Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "139.19.117.130",
"eventid": "cowrie.client.version",
"message": "Remote SSH version: SSH-2.0-Go",
"outfile": null,
"session": "fcb3b61f32d8",
"version": "SSH-2.0-Go",
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 35516,
"username": null,
"timestamp": "2026-10-29T07:34:11.891188Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"encCS": [
"aes128-ctr",
"aes192-ctr",
"aes256-ctr",
"aes128-gcm@openssh.com",
"arcfour256",
"arcfour128",
"arcfour",
"aes128-cbc",
"3des-cbc",
"aes128-ctr",
"aes192-ctr",
"aes256-ctr",
"aes128-gcm@openssh.com",
"arcfour256",
"arcfour128",
"arcfour",
"aes128-cbc",
"3des-cbc"
],
"hassh": "f1e5e9d24e5e345e8745613bde22d532",
"input": null,
"macCS": [
"hmac-sha2-256",
"hmac-sha1",
"hmac-sha1-96"
],
"compCS": [
"none"
],
"dst_ip": "172.18.0.2",
"langCS": [
""
],
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "139.19.117.130",
"eventid": "cowrie.client.kex",
"kexAlgs": [
"curve25519-sha256@libssh.org",
"ecdh-sha2-nistp256",
"ecdh-sha2-nistp384",
"ecdh-sha2-nistp521",
"diffie-hellman-group14-sha1",
"diffie-hellman-group1-sha1",
"diffie-hellman-group-exchange-sha1",
"diffie-hellman-group-exchange-sha256",
"curve25519-sha256@libssh.org",
"ecdh-sha2-nistp256",
"ecdh-sha2-nistp384",
"ecdh-sha2-nistp521",
"diffie-hellman-group14-sha1",
"diffie-hellman-group1-sha1",
"diffie-hellman-group-exchange-sha1",
"diffie-hellman-group-exchange-sha256"
],
"keyAlgs": [
"ssh-rsa-cert-v01@openssh.com",
"ssh-dss-cert-v01@openssh.com",
"ecdsa-sha2-nistp256-cert-v01@openssh.com",
"ecdsa-sha2-nistp384-cert-v01@openssh.com",
"ecdsa-sha2-nistp521-cert-v01@openssh.com",
"ssh-ed25519-cert-v01@openssh.com",
"ecdsa-sha2-nistp256",
"ecdsa-sha2-nistp384",
"ecdsa-sha2-nistp521",
"ssh-rsa",
"ssh-dss",
"ssh-ed25519",
"ssh-rsa-cert-v01@openssh.com",
"ssh-dss-cert-v01@openssh.com",
"ecdsa-sha2-nistp256-cert-v01@openssh.com",
"ecdsa-sha2-nistp384-cert-v01@openssh.com",
"ecdsa-sha2-nistp521-cert-v01@openssh.com",
"ssh-ed25519-cert-v01@openssh.com",
"ecdsa-sha2-nistp256",
"ecdsa-sha2-nistp384",
"ecdsa-sha2-nistp521",
"ssh-rsa",
"ssh-dss",
"ssh-ed25519"
],
"message": "SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532",
"outfile": null,
"session": "fcb3b61f32d8",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 35516,
"username": null,
"timestamp": "2026-10-29T07:34:12.005478Z",
"duration_ms": null,
"hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"
},
{
"key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuGpImNMYs18pI0vf9uo92skKKko1/CECMRjQFtPUvHompfX8mflBTEd1mJkMqYbSgNydIAigxnP4PeyTTAXUsmi9076bqeYTvdQ9SSrMXJsG4xJjyfhSxfbE6w9O90BxRt1/Mx2WIK1MHwlJ2t+lCdV/Mpw93wBJYdb8I8lvWz4punK7h1KYrVMGeqGFMUzUVz7zmpytbdOrSbt9KbbMUlgYXZdpfsFoL3fxswmXG51wxisjHw62nnxb76QjAHCBZhpkhbgqSz0EGKH6s4UihQ+Zo76CxA476TajadPrWqtT+N+aBzLukpoPKprR5+G48HTGBgyyDSQRC1ObOhkQj",
"url": null,
"type": "ssh-rsa",
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "139.19.117.130",
"eventid": "cowrie.client.fingerprint",
"message": "public key attempt for user admin of type ssh-rsa with fingerprint 3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7",
"outfile": null,
"session": "fcb3b61f32d8",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 35516,
"username": "admin",
"timestamp": "2026-10-29T07:34:12.235359Z",
"duration_ms": null,
"fingerprint": "3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7"
},
{
"key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuGpImNMYs18pI0vf9uo92skKKko1/CECMRjQFtPUvHompfX8mflBTEd1mJkMqYbSgNydIAigxnP4PeyTTAXUsmi9076bqeYTvdQ9SSrMXJsG4xJjyfhSxfbE6w9O90BxRt1/Mx2WIK1MHwlJ2t+lCdV/Mpw93wBJYdb8I8lvWz4punK7h1KYrVMGeqGFMUzUVz7zmpytbdOrSbt9KbbMUlgYXZdpfsFoL3fxswmXG51wxisjHw62nnxb76QjAHCBZhpkhbgqSz0EGKH6s4UihQ+Zo76CxA476TajadPrWqtT+N+aBzLukpoPKprR5+G48HTGBgyyDSQRC1ObOhkQj",
"url": null,
"type": "ssh-rsa",
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "139.19.117.130",
"eventid": "cowrie.login.failed",
"message": "public key login attempt for [admin] failed",
"outfile": null,
"session": "fcb3b61f32d8",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 35516,
"username": "admin",
"timestamp": "2026-10-29T07:34:12.235695Z",
"duration_ms": null,
"fingerprint": "3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7"
},
{
"key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuGpImNMYs18pI0vf9uo92skKKko1/CECMRjQFtPUvHompfX8mflBTEd1mJkMqYbSgNydIAigxnP4PeyTTAXUsmi9076bqeYTvdQ9SSrMXJsG4xJjyfhSxfbE6w9O90BxRt1/Mx2WIK1MHwlJ2t+lCdV/Mpw93wBJYdb8I8lvWz4punK7h1KYrVMGeqGFMUzUVz7zmpytbdOrSbt9KbbMUlgYXZdpfsFoL3fxswmXG51wxisjHw62nnxb76QjAHCBZhpkhbgqSz0EGKH6s4UihQ+Zo76CxA476TajadPrWqtT+N+aBzLukpoPKprR5+G48HTGBgyyDSQRC1ObOhkQj",
"url": null,
"type": "ssh-rsa",
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "139.19.117.130",
"eventid": "cowrie.client.fingerprint",
"message": "public key attempt for user admin of type ssh-rsa with fingerprint 3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7",
"outfile": null,
"session": "fcb3b61f32d8",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 35516,
"username": "admin",
"timestamp": "2026-10-29T07:34:12.350178Z",
"duration_ms": null,
"fingerprint": "3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7"
},
{
"key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuGpImNMYs18pI0vf9uo92skKKko1/CECMRjQFtPUvHompfX8mflBTEd1mJkMqYbSgNydIAigxnP4PeyTTAXUsmi9076bqeYTvdQ9SSrMXJsG4xJjyfhSxfbE6w9O90BxRt1/Mx2WIK1MHwlJ2t+lCdV/Mpw93wBJYdb8I8lvWz4punK7h1KYrVMGeqGFMUzUVz7zmpytbdOrSbt9KbbMUlgYXZdpfsFoL3fxswmXG51wxisjHw62nnxb76QjAHCBZhpkhbgqSz0EGKH6s4UihQ+Zo76CxA476TajadPrWqtT+N+aBzLukpoPKprR5+G48HTGBgyyDSQRC1ObOhkQj",
"url": null,
"type": "ssh-rsa",
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "139.19.117.130",
"eventid": "cowrie.login.failed",
"message": "public key login attempt for [admin] failed",
"outfile": null,
"session": "fcb3b61f32d8",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 35516,
"username": "admin",
"timestamp": "2026-10-29T07:34:12.350482Z",
"duration_ms": null,
"fingerprint": "3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7"
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "139.19.117.130",
"eventid": "cowrie.session.closed",
"message": "Connection lost after 10000 milliseconds",
"outfile": null,
"session": "fcb3b61f32d8",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 35516,
"username": null,
"timestamp": "2026-10-29T07:34:21.890825Z",
"duration_ms": 10000
}
],
"sensor": "hp-use-01",
"source": "cowrie",
"src_ip": "139.19.117.130",
"session_id": "fcb3b61f32d8"
}