Credential acceptance event recorded. Target authentication: root / passwd
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "8397baf2aeca",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:28:38.612551Z",
"end_time": "2026-08-01T15:28:39.985408Z",
"duration": "1.4",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "passwd"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: node / 123456
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "3f77d568c836",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:28:32.675700Z",
"end_time": "2026-08-01T15:28:34.138704Z",
"duration": "1.5",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "node",
"pass": "123456"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: fivem
{
"id": "d4099c3d8e79",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:28:26.713396Z",
"end_time": "2026-08-01T15:28:28.652141Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "fivem",
"pass": "password"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: git / 1234
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "9fecd8645735",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:28:21.002528Z",
"end_time": "2026-08-01T15:28:22.573244Z",
"duration": "1.6",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "git",
"pass": "1234"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: master
{
"id": "fbd4e650fa18",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:28:15.506338Z",
"end_time": "2026-08-01T15:28:17.656696Z",
"duration": "2.1",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "master",
"pass": "master"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: appuser
{
"id": "8830ea859410",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:28:10.040440Z",
"end_time": "2026-08-01T15:28:11.966977Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "appuser",
"pass": "test"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: kafka
{
"id": "e2eb154dc856",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:28:04.489905Z",
"end_time": "2026-08-01T15:28:06.376398Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "kafka",
"pass": "kafka"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: test_user
{
"id": "eaa44bfb99c8",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:59.144092Z",
"end_time": "2026-08-01T15:28:01.111569Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "test_user",
"pass": "1"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / P@ssword1
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "d540d4b8ce72",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:53.757008Z",
"end_time": "2026-08-01T15:27:55.049685Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "P@ssword1"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: claude
{
"id": "bd48ae2ea7b0",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:48.446158Z",
"end_time": "2026-08-01T15:27:50.245749Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "claude",
"pass": "claude"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: student
{
"id": "74bbbd9a9c18",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:42.851110Z",
"end_time": "2026-08-01T15:27:44.828022Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "student",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / Abcd1234
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "14ebf7f39f26",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:37.531107Z",
"end_time": "2026-08-01T15:27:38.870766Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Abcd1234"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: kali
{
"id": "4c12ce37ce8f",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:31.670868Z",
"end_time": "2026-08-01T15:27:33.629189Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "kali",
"pass": "kali"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / 1234
Remote entity achieved interactive shell state. Command sequence (9 executed):
{
"id": "7331a0299e91",
"src_ip": "195.178.110.227",
"start_time": "2026-08-01T15:27:26.802760Z",
"end_time": "2026-08-01T15:27:30.185626Z",
"duration": "3.4",
"version": "SSH-2.0-Go",
"hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "1234"
},
"commands": [
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
"uname -s -v -n -m 2 > /dev/null",
"/bin/uname -s -v -n -m 2 > /dev/null",
"/usr/bin/uname -s -v -n -m 2 > /dev/null",
"busybox uname -s -v -n -m 2 > /dev/null",
"( [ -f /proc/version ]",
"[ -f /proc/version ]",
"head -1 /proc/version | cut -d -f1",
"[ -f /etc/os-release ]"
],
"detailed_commands": [
{
"cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
"failed": false,
"error": null
},
{
"cmd": "uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
"failed": true,
"error": "Command not found: /usr/bin/uname -s -v -n -m"
},
{
"cmd": "busybox uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "( [ -f /proc/version ]",
"failed": false,
"error": null
},
{
"cmd": "[ -f /proc/version ]",
"failed": false,
"error": null
},
{
"cmd": "head -1 /proc/version | cut -d -f1",
"failed": false,
"error": null
},
{
"cmd": "[ -f /etc/os-release ]",
"failed": false,
"error": null
}
],
"failed_commands": [
"/usr/bin/uname -s -v -n -m"
],
"score": 200,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dev
{
"id": "85059b9daca8",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:26.572955Z",
"end_time": "2026-08-01T15:27:28.337365Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "dev",
"pass": "password"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pi
{
"id": "17060dc2e9c4",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:21.726034Z",
"end_time": "2026-08-01T15:27:23.643127Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "pi",
"pass": "1"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / huawei@123
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "3bf324ab1862",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:16.621456Z",
"end_time": "2026-08-01T15:27:17.969741Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "huawei@123"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: steam / 1
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "5377745bc7ac",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:11.833788Z",
"end_time": "2026-08-01T15:27:13.118812Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "steam",
"pass": "1"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: openclaw
{
"id": "f64f1e1d8342",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:06.794105Z",
"end_time": "2026-08-01T15:27:08.564049Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "openclaw",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: newuser
{
"id": "8fcdac1b25c1",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:27:01.942610Z",
"end_time": "2026-08-01T15:27:03.711988Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "newuser",
"pass": "qwerty"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: guest / 111111
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "4bec2c212d4e",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:56.709572Z",
"end_time": "2026-08-01T15:26:57.991046Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "guest",
"pass": "111111"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: postgres / 1
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "456d30e40c39",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:51.745384Z",
"end_time": "2026-08-01T15:26:53.219588Z",
"duration": "1.5",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "postgres",
"pass": "1"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rdpuser
{
"id": "5a0b9da81c6e",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:46.721826Z",
"end_time": "2026-08-01T15:26:48.684452Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "rdpuser",
"pass": "123456789"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: test / test1234
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "ddd33ae0b56b",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:42.022180Z",
"end_time": "2026-08-01T15:26:43.203616Z",
"duration": "1.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "test",
"pass": "test1234"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jellyfin
{
"id": "409818789394",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:36.991679Z",
"end_time": "2026-08-01T15:26:38.764584Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "jellyfin",
"pass": "123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: config
{
"id": "a77e4d798633",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:32.063949Z",
"end_time": "2026-08-01T15:26:33.824457Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "config",
"pass": "config"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: kingbase
{
"id": "3e5db6fbbdf0",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:27.164678Z",
"end_time": "2026-08-01T15:26:29.129763Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "kingbase",
"pass": "kingbase"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / root1234
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "bd873e9dc9ab",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:22.612969Z",
"end_time": "2026-08-01T15:26:23.894172Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "root1234"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: test1
{
"id": "a76cce83eeaa",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:17.572485Z",
"end_time": "2026-08-01T15:26:19.736295Z",
"duration": "2.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "test1",
"pass": "test123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: default
{
"id": "ba593c38d433",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:12.820410Z",
"end_time": "2026-08-01T15:26:14.589870Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "default",
"pass": "default"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: student
{
"id": "db8b21a50d1e",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:07.964836Z",
"end_time": "2026-08-01T15:26:10.093205Z",
"duration": "2.1",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "student",
"pass": "redhat"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: kingbase
{
"id": "d3292fc2b161",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:26:02.968355Z",
"end_time": "2026-08-01T15:26:04.874673Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "kingbase",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: deploy / dev
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "ac634830ad54",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:57.950387Z",
"end_time": "2026-08-01T15:25:59.101902Z",
"duration": "1.1",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "deploy",
"pass": "dev"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: appuser
{
"id": "aa3f63309a42",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:52.739478Z",
"end_time": "2026-08-01T15:25:54.518425Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "appuser",
"pass": "password"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sam
{
"id": "8bb4b01d1052",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:47.806620Z",
"end_time": "2026-08-01T15:25:49.643033Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "sam",
"pass": "1234567890"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: minecraft / password
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "2a04ad3914d7",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:42.602995Z",
"end_time": "2026-08-01T15:25:43.878933Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "minecraft",
"pass": "password"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: developer
{
"id": "e8e48ed2cd18",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:37.484864Z",
"end_time": "2026-08-01T15:25:39.259163Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "developer",
"pass": "root"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rdpuser
{
"id": "da798334d747",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:32.496854Z",
"end_time": "2026-08-01T15:25:34.262459Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "rdpuser",
"pass": "123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / zaq12wsx
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "855523d16198",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:27.564413Z",
"end_time": "2026-08-01T15:25:29.061140Z",
"duration": "1.5",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "zaq12wsx"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: root / 123321
Remote entity achieved interactive shell state. Command sequence (9 executed):
{
"id": "19d8ef77d7fa",
"src_ip": "195.178.110.227",
"start_time": "2026-08-01T15:25:25.376075Z",
"end_time": "2026-08-01T15:25:27.812831Z",
"duration": "2.4",
"version": "SSH-2.0-Go",
"hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "123321"
},
"commands": [
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
"uname -s -v -n -m 2 > /dev/null",
"/bin/uname -s -v -n -m 2 > /dev/null",
"/usr/bin/uname -s -v -n -m 2 > /dev/null",
"busybox uname -s -v -n -m 2 > /dev/null",
"( [ -f /proc/version ]",
"[ -f /proc/version ]",
"head -1 /proc/version | cut -d -f1",
"[ -f /etc/os-release ]"
],
"detailed_commands": [
{
"cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
"failed": false,
"error": null
},
{
"cmd": "uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
"failed": true,
"error": "Command not found: /usr/bin/uname -s -v -n -m"
},
{
"cmd": "busybox uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "( [ -f /proc/version ]",
"failed": false,
"error": null
},
{
"cmd": "[ -f /proc/version ]",
"failed": false,
"error": null
},
{
"cmd": "head -1 /proc/version | cut -d -f1",
"failed": false,
"error": null
},
{
"cmd": "[ -f /etc/os-release ]",
"failed": false,
"error": null
}
],
"failed_commands": [
"/usr/bin/uname -s -v -n -m"
],
"score": 200,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: drcomadmin
{
"id": "0666b97413f9",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:22.496050Z",
"end_time": "2026-08-01T15:25:24.274042Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "drcomadmin",
"pass": "drcomadmin123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: a
{
"id": "6c6fc4569f40",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:17.330028Z",
"end_time": "2026-08-01T15:25:19.232842Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "a",
"pass": "a"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / 1qazXSW@
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "77308620bbbd",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:12.154836Z",
"end_time": "2026-08-01T15:25:13.499076Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "1qazXSW@"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: opc
{
"id": "fdc668497a19",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:07.203570Z",
"end_time": "2026-08-01T15:25:09.213053Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "opc",
"pass": "opc"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / Root@123
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "b7c098db7b59",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:25:02.111724Z",
"end_time": "2026-08-01T15:25:03.338293Z",
"duration": "1.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Root@123"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: user / password
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "c44e73793fab",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:24:57.149331Z",
"end_time": "2026-08-01T15:24:58.495361Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "user",
"pass": "password"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: reza
{
"id": "6dcfbae9217e",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:24:52.130003Z",
"end_time": "2026-08-01T15:24:53.992451Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "reza",
"pass": "reza"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: frappe
{
"id": "b2ed92e67ce8",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:24:47.291662Z",
"end_time": "2026-08-01T15:24:49.058697Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "frappe",
"pass": "frappe"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: trinity
{
"id": "9dbfc556dcba",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:24:42.111399Z",
"end_time": "2026-08-01T15:24:43.878160Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "trinity",
"pass": "trinity"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / 051178
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "2ece84ba5d98",
"src_ip": "45.156.87.166",
"start_time": "2026-08-01T15:24:36.584762Z",
"end_time": "2026-08-01T15:24:37.749603Z",
"duration": "1.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "051178"
},
"commands": [
"uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}