SentinelBrief
← Alert queue

139.19.117.130

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S2brute_forceConfidence 90%Escalate: no

Reasoning

The attacker attempted to log in with the username 'root' but failed twice without any successful login or further commands executed. This indicates untargeted automation with generic credential attempts.

Recommended action

Monitor the IP address for further attempts and consider blocking if the behavior continues.

Routing

Primary model
gpt-4o-mini
Final model
gpt-4o-mini
Escalated to strong model
no
Prompt version
triage-v4
Input tokens
1,574
Output tokens
98
Cost
$0.000295
Latency
1,799 ms
Verdict at
2026-10-17 16:46:19Z

Tool trace

  1. No tool calls were made.

Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "139.19.117.130",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 139.19.117.130:56880 (172.18.0.2:2222) [session: 10e0601e83c6]",
      "outfile": null,
      "session": "10e0601e83c6",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56880,
      "username": null,
      "timestamp": "2026-10-17T16:46:08.187339Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "139.19.117.130",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "10e0601e83c6",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56880,
      "username": null,
      "timestamp": "2026-10-17T16:46:08.187646Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr",
        "aes128-gcm@openssh.com",
        "arcfour256",
        "arcfour128",
        "arcfour",
        "aes128-cbc",
        "3des-cbc",
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr",
        "aes128-gcm@openssh.com",
        "arcfour256",
        "arcfour128",
        "arcfour",
        "aes128-cbc",
        "3des-cbc"
      ],
      "hassh": "f1e5e9d24e5e345e8745613bde22d532",
      "input": null,
      "macCS": [
        "hmac-sha2-256",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "139.19.117.130",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha1",
        "diffie-hellman-group1-sha1",
        "diffie-hellman-group-exchange-sha1",
        "diffie-hellman-group-exchange-sha256",
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha1",
        "diffie-hellman-group1-sha1",
        "diffie-hellman-group-exchange-sha1",
        "diffie-hellman-group-exchange-sha256"
      ],
      "keyAlgs": [
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519",
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532",
      "outfile": null,
      "session": "10e0601e83c6",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56880,
      "username": null,
      "timestamp": "2026-10-17T16:46:08.303100Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJRgsG5aJCCjObRCFFp84cbZq0WWhs81iQSsGMHhy1cig0kCLpAswcHEvzXV6fDMJygYBNXlkj4iwKDMK2uT7pWp4TH5Qj5mfJr8Eh8E9jSob1c8IKBP7cC/fr2O0yh2tfJG7db7GeoHAOeesYrkpzYqyrUO44xLZP+0OHnhVIGPSWZOUS5eC1LqT1P+VqZBXuSKYCmXazif1+hnU4g16EAz4cuPNpn1g4CtQyi2F3QKtSxpf+wIthcBNvDwgD8PPXOkHpEy4kmjD22gopNFWwOvzq2j6W/ecTsn3qgsyngRFmSFqD5cvvLUwSGIrMemXPa7lIMeeiYFMgPVxum8XAKUeh3ms9KcGVgx6suvlxKItQ+DToMjuUAHvG0YeN/I9TRhmEQJfMeLFJ+6oIrQsJo3gXzpbKquJA1AjrDe3TjXw/KLoR2GVB5TeGzvTfC0AHPzTsbbgbimU6GWoyy7Kw4pE1wN7U0wC6k8lKSgOw1RfllVtLO5Rhv/Sp8x3kp+k=",
      "url": null,
      "type": "ssh-rsa",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "139.19.117.130",
      "eventid": "cowrie.client.fingerprint",
      "message": "public key attempt for user root of type ssh-rsa with fingerprint 60:a4:57:81:98:33:79:ef:1f:18:98:3b:5c:ec:c8:3f",
      "outfile": null,
      "session": "10e0601e83c6",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56880,
      "username": "root",
      "timestamp": "2026-10-17T16:46:08.535537Z",
      "duration_ms": null,
      "fingerprint": "60:a4:57:81:98:33:79:ef:1f:18:98:3b:5c:ec:c8:3f"
    },
    {
      "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJRgsG5aJCCjObRCFFp84cbZq0WWhs81iQSsGMHhy1cig0kCLpAswcHEvzXV6fDMJygYBNXlkj4iwKDMK2uT7pWp4TH5Qj5mfJr8Eh8E9jSob1c8IKBP7cC/fr2O0yh2tfJG7db7GeoHAOeesYrkpzYqyrUO44xLZP+0OHnhVIGPSWZOUS5eC1LqT1P+VqZBXuSKYCmXazif1+hnU4g16EAz4cuPNpn1g4CtQyi2F3QKtSxpf+wIthcBNvDwgD8PPXOkHpEy4kmjD22gopNFWwOvzq2j6W/ecTsn3qgsyngRFmSFqD5cvvLUwSGIrMemXPa7lIMeeiYFMgPVxum8XAKUeh3ms9KcGVgx6suvlxKItQ+DToMjuUAHvG0YeN/I9TRhmEQJfMeLFJ+6oIrQsJo3gXzpbKquJA1AjrDe3TjXw/KLoR2GVB5TeGzvTfC0AHPzTsbbgbimU6GWoyy7Kw4pE1wN7U0wC6k8lKSgOw1RfllVtLO5Rhv/Sp8x3kp+k=",
      "url": null,
      "type": "ssh-rsa",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "139.19.117.130",
      "eventid": "cowrie.login.failed",
      "message": "public key login attempt for [root] failed",
      "outfile": null,
      "session": "10e0601e83c6",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56880,
      "username": "root",
      "timestamp": "2026-10-17T16:46:08.535895Z",
      "duration_ms": null,
      "fingerprint": "60:a4:57:81:98:33:79:ef:1f:18:98:3b:5c:ec:c8:3f"
    },
    {
      "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJRgsG5aJCCjObRCFFp84cbZq0WWhs81iQSsGMHhy1cig0kCLpAswcHEvzXV6fDMJygYBNXlkj4iwKDMK2uT7pWp4TH5Qj5mfJr8Eh8E9jSob1c8IKBP7cC/fr2O0yh2tfJG7db7GeoHAOeesYrkpzYqyrUO44xLZP+0OHnhVIGPSWZOUS5eC1LqT1P+VqZBXuSKYCmXazif1+hnU4g16EAz4cuPNpn1g4CtQyi2F3QKtSxpf+wIthcBNvDwgD8PPXOkHpEy4kmjD22gopNFWwOvzq2j6W/ecTsn3qgsyngRFmSFqD5cvvLUwSGIrMemXPa7lIMeeiYFMgPVxum8XAKUeh3ms9KcGVgx6suvlxKItQ+DToMjuUAHvG0YeN/I9TRhmEQJfMeLFJ+6oIrQsJo3gXzpbKquJA1AjrDe3TjXw/KLoR2GVB5TeGzvTfC0AHPzTsbbgbimU6GWoyy7Kw4pE1wN7U0wC6k8lKSgOw1RfllVtLO5Rhv/Sp8x3kp+k=",
      "url": null,
      "type": "ssh-rsa",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "139.19.117.130",
      "eventid": "cowrie.client.fingerprint",
      "message": "public key attempt for user root of type ssh-rsa with fingerprint 60:a4:57:81:98:33:79:ef:1f:18:98:3b:5c:ec:c8:3f",
      "outfile": null,
      "session": "10e0601e83c6",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56880,
      "username": "root",
      "timestamp": "2026-10-17T16:46:08.651715Z",
      "duration_ms": null,
      "fingerprint": "60:a4:57:81:98:33:79:ef:1f:18:98:3b:5c:ec:c8:3f"
    },
    {
      "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJRgsG5aJCCjObRCFFp84cbZq0WWhs81iQSsGMHhy1cig0kCLpAswcHEvzXV6fDMJygYBNXlkj4iwKDMK2uT7pWp4TH5Qj5mfJr8Eh8E9jSob1c8IKBP7cC/fr2O0yh2tfJG7db7GeoHAOeesYrkpzYqyrUO44xLZP+0OHnhVIGPSWZOUS5eC1LqT1P+VqZBXuSKYCmXazif1+hnU4g16EAz4cuPNpn1g4CtQyi2F3QKtSxpf+wIthcBNvDwgD8PPXOkHpEy4kmjD22gopNFWwOvzq2j6W/ecTsn3qgsyngRFmSFqD5cvvLUwSGIrMemXPa7lIMeeiYFMgPVxum8XAKUeh3ms9KcGVgx6suvlxKItQ+DToMjuUAHvG0YeN/I9TRhmEQJfMeLFJ+6oIrQsJo3gXzpbKquJA1AjrDe3TjXw/KLoR2GVB5TeGzvTfC0AHPzTsbbgbimU6GWoyy7Kw4pE1wN7U0wC6k8lKSgOw1RfllVtLO5Rhv/Sp8x3kp+k=",
      "url": null,
      "type": "ssh-rsa",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "139.19.117.130",
      "eventid": "cowrie.login.failed",
      "message": "public key login attempt for [root] failed",
      "outfile": null,
      "session": "10e0601e83c6",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56880,
      "username": "root",
      "timestamp": "2026-10-17T16:46:08.652069Z",
      "duration_ms": null,
      "fingerprint": "60:a4:57:81:98:33:79:ef:1f:18:98:3b:5c:ec:c8:3f"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "139.19.117.130",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 10000 milliseconds",
      "outfile": null,
      "session": "10e0601e83c6",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 56880,
      "username": null,
      "timestamp": "2026-10-17T16:46:18.187423Z",
      "duration_ms": 10000
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "139.19.117.130",
  "session_id": "10e0601e83c6"
}