Adversarial Observation Interface

129.104.5.4

2026-08-04 00:49:22.908386 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 65ec815c09f7

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "65ec815c09f7",
  "src_ip": "129.104.5.4",
  "start_time": "2026-08-04T00:49:22.908386Z",
  "end_time": "2026-08-04T00:49:23.069530Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

172.94.9.43

2026-08-04 00:49:19.688913 UTC

RECONNAISSANCE SUCCESSFUL LOGIN COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / NONPRODUCTIONS@123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -a

Record ID: 6b04c3f3dec2

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "6b04c3f3dec2",
  "src_ip": "172.94.9.43",
  "start_time": "2026-08-04T00:49:19.688913Z",
  "end_time": "2026-08-04T00:49:21.859311Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "NONPRODUCTIONS@123"
  },
  "commands": [
    "uname -a"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

172.94.9.43

2026-08-04 00:49:19.361749 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f67e5ce49850

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "f67e5ce49850",
  "src_ip": "172.94.9.43",
  "start_time": "2026-08-04T00:49:19.361749Z",
  "end_time": "2026-08-04T00:49:19.535964Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

77.90.185.42

2026-08-04 00:47:52.655346 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debian

Record ID: 2a766dfe4755

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "2a766dfe4755",
  "src_ip": "77.90.185.42",
  "start_time": "2026-08-04T00:47:52.655346Z",
  "end_time": "2026-08-04T00:47:54.503845Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [
    {
      "user": "debian",
      "pass": "Nonproductions123#"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

77.90.185.42

2026-08-04 00:47:52.322885 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e6aca5071ac7

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "e6aca5071ac7",
  "src_ip": "77.90.185.42",
  "start_time": "2026-08-04T00:47:52.322885Z",
  "end_time": "2026-08-04T00:47:52.491659Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

192.253.248.65

2026-08-04 00:45:38.660184 UTC

RECONNAISSANCE SUCCESSFUL LOGIN COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / nonproductions@2024

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -a

Record ID: 1f7391207662

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "1f7391207662",
  "src_ip": "192.253.248.65",
  "start_time": "2026-08-04T00:45:38.660184Z",
  "end_time": "2026-08-04T00:45:40.362675Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "nonproductions@2024"
  },
  "commands": [
    "uname -a"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

192.253.248.65

2026-08-04 00:45:38.331416 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6d05827aa76d

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "6d05827aa76d",
  "src_ip": "192.253.248.65",
  "start_time": "2026-08-04T00:45:38.331416Z",
  "end_time": "2026-08-04T00:45:38.498502Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

103.185.52.113

2026-08-04 00:45:34.498315 UTC

RECONNAISSANCE SUCCESSFUL LOGIN COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: admin / Nonproductions#2026

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -a

Record ID: e0df940b19d3

Client Version: SSH-2.0-Go

Engagement Duration: 2.7s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "e0df940b19d3",
  "src_ip": "103.185.52.113",
  "start_time": "2026-08-04T00:45:34.498315Z",
  "end_time": "2026-08-04T00:45:37.222920Z",
  "duration": "2.7",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "Nonproductions#2026"
  },
  "commands": [
    "uname -a"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

103.185.52.113

2026-08-04 00:45:33.745087 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: dbb74341e310

Client Version: Unknown

Engagement Duration: 0.6s

{
  "id": "dbb74341e310",
  "src_ip": "103.185.52.113",
  "start_time": "2026-08-04T00:45:33.745087Z",
  "end_time": "2026-08-04T00:45:34.301690Z",
  "duration": "0.6",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

51.38.115.161

2026-08-04 00:45:26.248596 UTC

RECONNAISSANCE SUCCESSFUL LOGIN COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / nonproductions2023#

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -a

Record ID: 403286206bab

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "403286206bab",
  "src_ip": "51.38.115.161",
  "start_time": "2026-08-04T00:45:26.248596Z",
  "end_time": "2026-08-04T00:45:27.590993Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "nonproductions2023#"
  },
  "commands": [
    "uname -a"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

51.38.115.161

2026-08-04 00:45:25.930809 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e13047274905

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "e13047274905",
  "src_ip": "51.38.115.161",
  "start_time": "2026-08-04T00:45:25.930809Z",
  "end_time": "2026-08-04T00:45:26.091492Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

138.197.159.9

2026-08-04 00:42:39.474590 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nonproductions

Record ID: 7edcd4369e7e

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "7edcd4369e7e",
  "src_ip": "138.197.159.9",
  "start_time": "2026-08-04T00:42:39.474590Z",
  "end_time": "2026-08-04T00:42:40.906344Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [
    {
      "user": "nonproductions",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

138.197.159.9

2026-08-04 00:42:39.297907 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 467e470565bc

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "467e470565bc",
  "src_ip": "138.197.159.9",
  "start_time": "2026-08-04T00:42:39.297907Z",
  "end_time": "2026-08-04T00:42:39.392608Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

91.92.40.31

2026-08-04 00:31:29.548310 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a77161506806

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "a77161506806",
  "src_ip": "91.92.40.31",
  "start_time": "2026-08-04T00:31:29.548310Z",
  "end_time": "2026-08-04T00:31:29.698720Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

77.90.185.203

2026-08-04 00:30:12.816492 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nonproductions

Record ID: 8331da24eca2

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "8331da24eca2",
  "src_ip": "77.90.185.203",
  "start_time": "2026-08-04T00:30:12.816492Z",
  "end_time": "2026-08-04T00:30:14.666310Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [
    {
      "user": "nonproductions",
      "pass": "nonproductions"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

77.90.185.203

2026-08-04 00:30:12.483393 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: daa26e9957e5

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "daa26e9957e5",
  "src_ip": "77.90.185.203",
  "start_time": "2026-08-04T00:30:12.483393Z",
  "end_time": "2026-08-04T00:30:12.651806Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.57.121.25

2026-08-04 00:23:40.147880 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / riviera

Record ID: 97b33afdf0a0

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.2s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "97b33afdf0a0",
  "src_ip": "2.57.121.25",
  "start_time": "2026-08-04T00:23:40.147880Z",
  "end_time": "2026-08-04T00:23:46.308010Z",
  "duration": "6.2",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "riviera"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

2.57.121.112

2026-08-04 00:19:10.095094 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: tanner

Record ID: 0bf9436aa659

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.6s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "0bf9436aa659",
  "src_ip": "2.57.121.112",
  "start_time": "2026-08-04T00:19:10.095094Z",
  "end_time": "2026-08-04T00:19:16.659436Z",
  "duration": "6.6",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "tanner",
      "pass": "tanner"
    },
    {
      "user": "tanner",
      "pass": "tanner1"
    },
    {
      "user": "tanner",
      "pass": "tanner123"
    },
    {
      "user": "tanner",
      "pass": "tanner1234"
    },
    {
      "user": "tanner",
      "pass": "tanner12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

199.45.154.74

2026-08-04 00:02:58.751703 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: aa3977140bea

Client Version: SSH-2.0-Go

Engagement Duration: 15.0s

HASSH Fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc

{
  "id": "aa3977140bea",
  "src_ip": "199.45.154.74",
  "start_time": "2026-08-04T00:02:58.751703Z",
  "end_time": "2026-08-04T00:03:13.751788Z",
  "duration": "15.0",
  "version": "SSH-2.0-Go",
  "hassh": "873a5fb5fedc2d4f8638ebde4abc6cfc",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

185.212.171.150

2026-08-03 23:57:59.969050 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / __hp_probe_pass_xyzzy_definitely_not_real__

Record ID: 478cc2655a11

Client Version: SSH-2.0-paramiko_3.5.1

Engagement Duration: 1.0s

HASSH Fingerprint: a2de0f306611e0957be704f5b0e35a82

{
  "id": "478cc2655a11",
  "src_ip": "185.212.171.150",
  "start_time": "2026-08-03T23:57:59.969050Z",
  "end_time": "2026-08-03T23:58:00.966819Z",
  "duration": "1.0",
  "version": "SSH-2.0-paramiko_3.5.1",
  "hassh": "a2de0f306611e0957be704f5b0e35a82",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "__hp_probe_pass_xyzzy_definitely_not_real__"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

185.212.171.150

2026-08-03 23:57:58.940498 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: 721fc6acb378

Client Version: SSH-2.0-paramiko_3.5.1

Engagement Duration: 1.0s

HASSH Fingerprint: a2de0f306611e0957be704f5b0e35a82

{
  "id": "721fc6acb378",
  "src_ip": "185.212.171.150",
  "start_time": "2026-08-03T23:57:58.940498Z",
  "end_time": "2026-08-03T23:57:59.931138Z",
  "duration": "1.0",
  "version": "SSH-2.0-paramiko_3.5.1",
  "hassh": "a2de0f306611e0957be704f5b0e35a82",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

185.212.171.150

2026-08-03 23:53:01.471843 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ubnt

Record ID: c6c3dedaff8c

Client Version: SSH-2.0-paramiko_3.5.1

Engagement Duration: 2.0s

HASSH Fingerprint: a2de0f306611e0957be704f5b0e35a82

{
  "id": "c6c3dedaff8c",
  "src_ip": "185.212.171.150",
  "start_time": "2026-08-03T23:53:01.471843Z",
  "end_time": "2026-08-03T23:53:03.464445Z",
  "duration": "2.0",
  "version": "SSH-2.0-paramiko_3.5.1",
  "hassh": "a2de0f306611e0957be704f5b0e35a82",
  "attempts": [
    {
      "user": "ubnt",
      "pass": "ubnt"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

20.64.105.54

2026-08-03 23:52:40.726750 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 20733e94a44d

Client Version: MGLNDD_184.98.6.225_22

Engagement Duration: 0.0s

{
  "id": "20733e94a44d",
  "src_ip": "20.64.105.54",
  "start_time": "2026-08-03T23:52:40.726750Z",
  "end_time": "2026-08-03T23:52:40.732652Z",
  "duration": "0.0",
  "version": "MGLNDD_184.98.6.225_22",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

20.64.105.54

2026-08-03 23:52:30.634914 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c1099f71820d

Client Version: Unknown

Engagement Duration: 10.1s

{
  "id": "c1099f71820d",
  "src_ip": "20.64.105.54",
  "start_time": "2026-08-03T23:52:30.634914Z",
  "end_time": "2026-08-03T23:52:40.694785Z",
  "duration": "10.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

193.46.255.86

2026-08-03 23:40:29.283782 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: user / 1234

Record ID: 7ecf91ea9d7f

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "7ecf91ea9d7f",
  "src_ip": "193.46.255.86",
  "start_time": "2026-08-03T23:40:29.283782Z",
  "end_time": "2026-08-03T23:40:35.300969Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "1234"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

2.57.121.25

2026-08-03 23:12:46.291859 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / romain

Record ID: 836d0938e8ad

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "836d0938e8ad",
  "src_ip": "2.57.121.25",
  "start_time": "2026-08-03T23:12:46.291859Z",
  "end_time": "2026-08-03T23:12:52.302108Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "romain"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.25

2026-08-03 22:48:44.145134 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / ankurkudintzi

Record ID: 2a5d0108823d

Client Version: SSH-2.0-Go

Engagement Duration: 9.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "2a5d0108823d",
  "src_ip": "91.92.40.25",
  "start_time": "2026-08-03T22:48:44.145134Z",
  "end_time": "2026-08-03T22:48:53.821666Z",
  "duration": "9.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ankurkudintzi"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.25

2026-08-03 22:48:21.479471 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 167606d37549

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "167606d37549",
  "src_ip": "91.92.40.25",
  "start_time": "2026-08-03T22:48:21.479471Z",
  "end_time": "2026-08-03T22:48:21.623434Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

124.223.38.27

2026-08-03 22:44:57.952788 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1a56817cdf92

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "1a56817cdf92",
  "src_ip": "124.223.38.27",
  "start_time": "2026-08-03T22:44:57.952788Z",
  "end_time": "2026-08-03T22:44:58.116209Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.57.121.112

2026-08-03 22:40:23.386168 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: saira

Record ID: c25674452178

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.7s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "c25674452178",
  "src_ip": "2.57.121.112",
  "start_time": "2026-08-03T22:40:23.386168Z",
  "end_time": "2026-08-03T22:40:30.063530Z",
  "duration": "6.7",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "saira",
      "pass": "saira"
    },
    {
      "user": "saira",
      "pass": "saira1"
    },
    {
      "user": "saira",
      "pass": "saira123"
    },
    {
      "user": "saira",
      "pass": "saira1234"
    },
    {
      "user": "saira",
      "pass": "saira12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

198.235.24.68

2026-08-03 22:22:01.755451 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 56f1f58e1493

Client Version: SSH-2.0-ZGrab ZGrab SSH Survey

Engagement Duration: 3.4s

HASSH Fingerprint: dd9bcf093c355da7000132131cb36fd0

{
  "id": "56f1f58e1493",
  "src_ip": "198.235.24.68",
  "start_time": "2026-08-03T22:22:01.755451Z",
  "end_time": "2026-08-03T22:22:05.176073Z",
  "duration": "3.4",
  "version": "SSH-2.0-ZGrab ZGrab SSH Survey",
  "hassh": "dd9bcf093c355da7000132131cb36fd0",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

176.53.159.199

2026-08-03 22:17:05.266308 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e6ff36223755

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "e6ff36223755",
  "src_ip": "176.53.159.199",
  "start_time": "2026-08-03T22:17:05.266308Z",
  "end_time": "2026-08-03T22:17:05.430350Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

193.46.255.86

2026-08-03 22:14:19.980870 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (3 distinct queries). Vector identities: ubnt

Record ID: 0de5cf0cc72c

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 4.2s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "0de5cf0cc72c",
  "src_ip": "193.46.255.86",
  "start_time": "2026-08-03T22:14:19.980870Z",
  "end_time": "2026-08-03T22:14:24.158893Z",
  "duration": "4.2",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "ubnt",
      "pass": "ubnt"
    },
    {
      "user": "ubnt",
      "pass": "ubnt1"
    },
    {
      "user": "ubnt",
      "pass": "admin"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.121.25

2026-08-03 22:00:29.082425 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / sandys

Record ID: 75fa25a29bc4

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "75fa25a29bc4",
  "src_ip": "2.57.121.25",
  "start_time": "2026-08-03T22:00:29.082425Z",
  "end_time": "2026-08-03T22:00:35.091193Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "sandys"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

192.168.0.1

2026-08-03 21:54:29.120508 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 673c4d6c591d

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "673c4d6c591d",
  "src_ip": "192.168.0.1",
  "start_time": "2026-08-03T21:54:29.120508Z",
  "end_time": "2026-08-03T21:54:29.131908Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

91.92.40.45

2026-08-03 21:42:40.699686 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / ankurkudintzi

Record ID: f4ef7657134f

Client Version: SSH-2.0-Go

Engagement Duration: 2.6s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "f4ef7657134f",
  "src_ip": "91.92.40.45",
  "start_time": "2026-08-03T21:42:40.699686Z",
  "end_time": "2026-08-03T21:42:43.302276Z",
  "duration": "2.6",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ankurkudintzi"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.45

2026-08-03 21:42:22.265940 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f12e71329c01

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "f12e71329c01",
  "src_ip": "91.92.40.45",
  "start_time": "2026-08-03T21:42:22.265940Z",
  "end_time": "2026-08-03T21:42:22.417275Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

115.231.78.11

2026-08-03 21:09:31.809997 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1cf387236cef

Client Version: SSH-2.0-libssh2_1.4.3

Engagement Duration: 1.0s

HASSH Fingerprint: 1df281da760a0c16d115179a9ea5957c

{
  "id": "1cf387236cef",
  "src_ip": "115.231.78.11",
  "start_time": "2026-08-03T21:09:31.809997Z",
  "end_time": "2026-08-03T21:09:32.810799Z",
  "duration": "1.0",
  "version": "SSH-2.0-libssh2_1.4.3",
  "hassh": "1df281da760a0c16d115179a9ea5957c",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.57.121.112

2026-08-03 20:59:16.360419 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: reece

Record ID: 4a584e4ebcf5

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.5s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "4a584e4ebcf5",
  "src_ip": "2.57.121.112",
  "start_time": "2026-08-03T20:59:16.360419Z",
  "end_time": "2026-08-03T20:59:22.883577Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "reece",
      "pass": "reece"
    },
    {
      "user": "reece",
      "pass": "reece1"
    },
    {
      "user": "reece",
      "pass": "reece123"
    },
    {
      "user": "reece",
      "pass": "reece1234"
    },
    {
      "user": "reece",
      "pass": "reece12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.46.255.86

2026-08-03 20:46:39.427510 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: 3e64506c0afa

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "3e64506c0afa",
  "src_ip": "193.46.255.86",
  "start_time": "2026-08-03T20:46:39.427510Z",
  "end_time": "2026-08-03T20:46:45.441002Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

2.57.121.25

2026-08-03 20:46:27.057740 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / schneider

Record ID: 077af68323b4

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "077af68323b4",
  "src_ip": "2.57.121.25",
  "start_time": "2026-08-03T20:46:27.057740Z",
  "end_time": "2026-08-03T20:46:33.063190Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "schneider"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

92.118.39.77

2026-08-03 20:46:15.748556 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 200

Credential acceptance event recorded. Target authentication: root / 12

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

[obs-node]:~$ uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null

Command not found: /usr/bin/uname -s -v -n -m

[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ ( [ -f /proc/version ]

[obs-node]:~$ [ -f /proc/version ]

[obs-node]:~$ head -1 /proc/version | cut -d -f1

[obs-node]:~$ [ -f /etc/os-release ]

Record ID: b32ce6fc4854

Client Version: SSH-2.0-Go

Engagement Duration: 1.5s

HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5

{
  "id": "b32ce6fc4854",
  "src_ip": "92.118.39.77",
  "start_time": "2026-08-03T20:46:15.748556Z",
  "end_time": "2026-08-03T20:46:17.210724Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "12"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

92.118.39.77

2026-08-03 20:43:17.343974 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 200

Credential acceptance event recorded. Target authentication: root / 1

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

[obs-node]:~$ uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null

Command not found: /usr/bin/uname -s -v -n -m

[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ ( [ -f /proc/version ]

[obs-node]:~$ [ -f /proc/version ]

[obs-node]:~$ head -1 /proc/version | cut -d -f1

[obs-node]:~$ [ -f /etc/os-release ]

Record ID: c12e45cdd3ea

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5

{
  "id": "c12e45cdd3ea",
  "src_ip": "92.118.39.77",
  "start_time": "2026-08-03T20:43:17.343974Z",
  "end_time": "2026-08-03T20:43:19.068931Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

92.118.39.77

2026-08-03 20:34:13.385397 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c8847ad027cc

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "c8847ad027cc",
  "src_ip": "92.118.39.77",
  "start_time": "2026-08-03T20:34:13.385397Z",
  "end_time": "2026-08-03T20:34:13.552078Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

36.154.15.210

2026-08-03 20:10:13.967705 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / ------fuck------

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -m

Record ID: 23205de12761

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 98f63c4d9c87edbd97ed4747fa031019

{
  "id": "23205de12761",
  "src_ip": "36.154.15.210",
  "start_time": "2026-08-03T20:10:13.967705Z",
  "end_time": "2026-08-03T20:10:15.821830Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "98f63c4d9c87edbd97ed4747fa031019",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "\ufeff------fuck------"
  },
  "commands": [
    "uname -s -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

36.154.15.210

2026-08-03 20:10:13.531044 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 516340ffa8a4

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "516340ffa8a4",
  "src_ip": "36.154.15.210",
  "start_time": "2026-08-03T20:10:13.531044Z",
  "end_time": "2026-08-03T20:10:13.754559Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

195.96.139.153

2026-08-03 19:41:43.028851 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 014b93002ab5

Client Version: SSH-2.0-Go

Engagement Duration: 0.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "014b93002ab5",
  "src_ip": "195.96.139.153",
  "start_time": "2026-08-03T19:41:43.028851Z",
  "end_time": "2026-08-03T19:41:43.319308Z",
  "duration": "0.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

195.96.139.153

2026-08-03 19:41:40.889925 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d037ac96adfb

Client Version: Unknown

Engagement Duration: 2.0s

{
  "id": "d037ac96adfb",
  "src_ip": "195.96.139.153",
  "start_time": "2026-08-03T19:41:40.889925Z",
  "end_time": "2026-08-03T19:41:42.890220Z",
  "duration": "2.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

192.248.150.180

2026-08-03 19:33:28.735122 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0611a4adbd88

Client Version: SSH-2.0-Go

Engagement Duration: 0.7s

HASSH Fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd

{
  "id": "0611a4adbd88",
  "src_ip": "192.248.150.180",
  "start_time": "2026-08-03T19:33:28.735122Z",
  "end_time": "2026-08-03T19:33:29.458320Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "e54ef3ec27fe1fea7ab64d3fa05359fd",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

221.222.16.229

2026-08-03 19:30:05.798972 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0ea9efa9b7d5

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "0ea9efa9b7d5",
  "src_ip": "221.222.16.229",
  "start_time": "2026-08-03T19:30:05.798972Z",
  "end_time": "2026-08-03T19:32:05.804006Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}