nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 1821 / 10047 (502321 total records)
Passive Observation Node - Active Operational Overview
217.60.255.130
2026-08-19 23:30:51.097334 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / Root@123

Record ID: 4e835e4d2cbc
Client Version: SSH-2.0-libssh_0.10.4
Engagement Duration: 2.1s
HASSH Fingerprint: 419da4c91ddbffebead14645bebc93b9
{
  "id": "4e835e4d2cbc",
  "src_ip": "217.60.255.130",
  "start_time": "2026-08-19T23:30:51.097334Z",
  "end_time": "2026-08-19T23:30:53.153189Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.10.4",
  "hassh": "419da4c91ddbffebead14645bebc93b9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Root@123"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
193.46.255.86
2026-08-19 23:20:08.741868 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (3 distinct queries). Vector identities: service

Record ID: ac6867a21745
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 4.2s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "ac6867a21745",
  "src_ip": "193.46.255.86",
  "start_time": "2026-08-19T23:20:08.741868Z",
  "end_time": "2026-08-19T23:20:12.930101Z",
  "duration": "4.2",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "service",
      "pass": "service"
    },
    {
      "user": "service",
      "pass": "abcd1234"
    },
    {
      "user": "service",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.193.88.131
2026-08-19 23:20:01.299507 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1868e9f5de63
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "1868e9f5de63",
  "src_ip": "41.193.88.131",
  "start_time": "2026-08-19T23:20:01.299507Z",
  "end_time": "2026-08-19T23:20:01.302987Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
41.193.88.131
2026-08-19 23:19:42.905748 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f05588997dd6
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "f05588997dd6",
  "src_ip": "41.193.88.131",
  "start_time": "2026-08-19T23:19:42.905748Z",
  "end_time": "2026-08-19T23:19:42.909152Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
116.74.164.106
2026-08-19 23:17:19.801677 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 0000

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec
Record ID: db84ec6d059b
Client Version: SSH-2.0-Go
Engagement Duration: 1.9s
HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6
{
  "id": "db84ec6d059b",
  "src_ip": "116.74.164.106",
  "start_time": "2026-08-19T23:17:19.801677Z",
  "end_time": "2026-08-19T23:17:21.726288Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "0000"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
139.19.117.130
2026-08-19 23:17:03.268284 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: admin

Record ID: 5e3d091d0252
Client Version: SSH-2.0-Go
Engagement Duration: 10.0s
HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532
{
  "id": "5e3d091d0252",
  "src_ip": "139.19.117.130",
  "start_time": "2026-08-19T23:17:03.268284Z",
  "end_time": "2026-08-19T23:17:13.267498Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "admin",
      "pass": null
    },
    {
      "user": "admin",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
23.175.50.52
2026-08-19 23:12:38.053737 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: user / kisan

Record ID: eb1d6978389d
Client Version: SSH-2.0-PuTTY_Release_0.70
Engagement Duration: 22.5s
HASSH Fingerprint: 0425c279610910d2d9aef3b285e59b86
{
  "id": "eb1d6978389d",
  "src_ip": "23.175.50.52",
  "start_time": "2026-08-19T23:12:38.053737Z",
  "end_time": "2026-08-19T23:13:00.513579Z",
  "duration": "22.5",
  "version": "SSH-2.0-PuTTY_Release_0.70",
  "hassh": "0425c279610910d2d9aef3b285e59b86",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "kisan"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
74.244.5.235
2026-08-19 23:11:12.589133 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f0a630eaa739
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "f0a630eaa739",
  "src_ip": "74.244.5.235",
  "start_time": "2026-08-19T23:11:12.589133Z",
  "end_time": "2026-08-19T23:11:12.593270Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
78.174.112.52
2026-08-19 23:06:12.211973 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5a0a519a11e6
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "5a0a519a11e6",
  "src_ip": "78.174.112.52",
  "start_time": "2026-08-19T23:06:12.211973Z",
  "end_time": "2026-08-19T23:06:12.215429Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
217.60.255.130
2026-08-19 23:05:50.881311 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / Root123

Record ID: 0df8a3b9fb35
Client Version: SSH-2.0-libssh_0.10.4
Engagement Duration: 2.2s
HASSH Fingerprint: 419da4c91ddbffebead14645bebc93b9
{
  "id": "0df8a3b9fb35",
  "src_ip": "217.60.255.130",
  "start_time": "2026-08-19T23:05:50.881311Z",
  "end_time": "2026-08-19T23:05:53.073813Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.10.4",
  "hassh": "419da4c91ddbffebead14645bebc93b9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Root123"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
23.175.50.52
2026-08-19 22:50:15.938470 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: user / kisan

Record ID: 7ed4cac8e850
Client Version: SSH-2.0-PuTTY_Release_0.70
Engagement Duration: 1.3s
HASSH Fingerprint: 0425c279610910d2d9aef3b285e59b86
{
  "id": "7ed4cac8e850",
  "src_ip": "23.175.50.52",
  "start_time": "2026-08-19T22:50:15.938470Z",
  "end_time": "2026-08-19T22:50:17.269690Z",
  "duration": "1.3",
  "version": "SSH-2.0-PuTTY_Release_0.70",
  "hassh": "0425c279610910d2d9aef3b285e59b86",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "kisan"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
116.74.164.106
2026-08-19 22:43:57.035203 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 00

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec
Record ID: 4662eb6b0f71
Client Version: SSH-2.0-Go
Engagement Duration: 1.8s
HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6
{
  "id": "4662eb6b0f71",
  "src_ip": "116.74.164.106",
  "start_time": "2026-08-19T22:43:57.035203Z",
  "end_time": "2026-08-19T22:43:58.881828Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "00"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
93.170.162.51
2026-08-19 22:43:55.440895 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f81b55b80a0f
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "f81b55b80a0f",
  "src_ip": "93.170.162.51",
  "start_time": "2026-08-19T22:43:55.440895Z",
  "end_time": "2026-08-19T22:43:55.444254Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
2.57.121.112
2026-08-19 22:43:19.655724 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: sylvester

Record ID: fc0a339094ea
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.5s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "fc0a339094ea",
  "src_ip": "2.57.121.112",
  "start_time": "2026-08-19T22:43:19.655724Z",
  "end_time": "2026-08-19T22:43:26.175768Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "sylvester",
      "pass": "sylvester"
    },
    {
      "user": "sylvester",
      "pass": "sylvester1"
    },
    {
      "user": "sylvester",
      "pass": "sylvester123"
    },
    {
      "user": "sylvester",
      "pass": "sylvester1234"
    },
    {
      "user": "sylvester",
      "pass": "sylvester12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
217.60.255.130
2026-08-19 22:39:38.815198 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / Root

Record ID: c0de5adc1f27
Client Version: SSH-2.0-libssh_0.10.4
Engagement Duration: 2.1s
HASSH Fingerprint: 419da4c91ddbffebead14645bebc93b9
{
  "id": "c0de5adc1f27",
  "src_ip": "217.60.255.130",
  "start_time": "2026-08-19T22:39:38.815198Z",
  "end_time": "2026-08-19T22:39:40.927571Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.10.4",
  "hassh": "419da4c91ddbffebead14645bebc93b9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Root "
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
176.53.159.196
2026-08-19 22:34:08.694844 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 0966a74d1616
Client Version: SSH-2.0-Go
Engagement Duration: 1.2s
HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53
{
  "id": "0966a74d1616",
  "src_ip": "176.53.159.196",
  "start_time": "2026-08-19T22:34:08.694844Z",
  "end_time": "2026-08-19T22:34:09.863606Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
190.139.113.59
2026-08-19 22:23:47.250530 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7f31d4ab0241
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "7f31d4ab0241",
  "src_ip": "190.139.113.59",
  "start_time": "2026-08-19T22:23:47.250530Z",
  "end_time": "2026-08-19T22:23:47.253886Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
190.139.113.59
2026-08-19 22:22:13.551211 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0b814a5fc32b
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "0b814a5fc32b",
  "src_ip": "190.139.113.59",
  "start_time": "2026-08-19T22:22:13.551211Z",
  "end_time": "2026-08-19T22:22:13.554527Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
179.37.50.20
2026-08-19 22:18:20.892276 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f8671ee542d7
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "f8671ee542d7",
  "src_ip": "179.37.50.20",
  "start_time": "2026-08-19T22:18:20.892276Z",
  "end_time": "2026-08-19T22:18:20.895558Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
179.37.50.20
2026-08-19 22:17:28.943002 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 3235d03f08b0
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "3235d03f08b0",
  "src_ip": "179.37.50.20",
  "start_time": "2026-08-19T22:17:28.943002Z",
  "end_time": "2026-08-19T22:17:28.946068Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
139.19.117.130
2026-08-19 22:17:03.578192 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: admin

Record ID: 66682c64495d
Client Version: SSH-2.0-Go
Engagement Duration: 10.0s
HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532
{
  "id": "66682c64495d",
  "src_ip": "139.19.117.130",
  "start_time": "2026-08-19T22:17:03.578192Z",
  "end_time": "2026-08-19T22:17:13.577514Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "admin",
      "pass": null
    },
    {
      "user": "admin",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
192.168.0.1
2026-08-19 22:14:55.843310 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: af290efe8a89
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "af290efe8a89",
  "src_ip": "192.168.0.1",
  "start_time": "2026-08-19T22:14:55.843310Z",
  "end_time": "2026-08-19T22:14:55.854468Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
217.60.255.130
2026-08-19 22:12:42.606457 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / root123

Record ID: aea8cbad16af
Client Version: SSH-2.0-libssh_0.10.4
Engagement Duration: 3.2s
HASSH Fingerprint: 419da4c91ddbffebead14645bebc93b9
{
  "id": "aea8cbad16af",
  "src_ip": "217.60.255.130",
  "start_time": "2026-08-19T22:12:42.606457Z",
  "end_time": "2026-08-19T22:12:45.848425Z",
  "duration": "3.2",
  "version": "SSH-2.0-libssh_0.10.4",
  "hassh": "419da4c91ddbffebead14645bebc93b9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root123"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
147.185.132.76
2026-08-19 22:09:53.173028 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: dde56ed91ff6
Client Version: SSH-2.0-ZGrab ZGrab SSH Survey
Engagement Duration: 3.1s
HASSH Fingerprint: dd9bcf093c355da7000132131cb36fd0
{
  "id": "dde56ed91ff6",
  "src_ip": "147.185.132.76",
  "start_time": "2026-08-19T22:09:53.173028Z",
  "end_time": "2026-08-19T22:09:56.262137Z",
  "duration": "3.1",
  "version": "SSH-2.0-ZGrab ZGrab SSH Survey",
  "hassh": "dd9bcf093c355da7000132131cb36fd0",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
43.153.114.203
2026-08-19 22:06:28.122116 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ chmod +x ./.6335344173072655702/sshd;nohup ./.6335344173072655702/sshd 191.252.210.242 77.239.125.227 27.0.135.12 45.118.144.36 218.98.97.7 154.211.13.102 188.248.254.9 31.77.145.89 165.232.148.95 192.140.185.8 138.99.79.29 106.13.167.239 177.70.2.194 45.126.120.53 223.243.162.130 202.134.23.229 122.193.64.145 106.75.166.71 158.51.96.38 2.189.130.67 188.166.211.175 96.44.161.98 124.174.58.106 172.245.43.228 111.67.19.59 103.139.101.114 42.4.62.108 161.129.211.63 106.13.57.206 205.185.126.219 203.154.14.8 217.18.94.226 121.228.250.70 112.53.123.177 65.181.92.228 101.36.228.201 219.248.115.178 45.234.176.26 203.186.60.250 129.212.239.56 140.206.107.98 203.189.196.168 170.84.39.236 106.75.216.134 103.219.32.239 103.166.226.235 114.218.57.21 51.195.223.189 177.74.153.10 180.108.46.6 3.92.224.153 &
Record ID: d3f4dbedbbcc
Client Version: SSH-2.0-Go
Engagement Duration: 23.4s
HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6
{
  "id": "d3f4dbedbbcc",
  "src_ip": "43.153.114.203",
  "start_time": "2026-08-19T22:06:28.122116Z",
  "end_time": "2026-08-19T22:06:51.533881Z",
  "duration": "23.4",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu"
  },
  "commands": [
    "chmod +x ./.6335344173072655702/sshd;nohup ./.6335344173072655702/sshd 191.252.210.242 77.239.125.227 27.0.135.12 45.118.144.36 218.98.97.7 154.211.13.102 188.248.254.9 31.77.145.89 165.232.148.95 192.140.185.8 138.99.79.29 106.13.167.239 177.70.2.194 45.126.120.53 223.243.162.130 202.134.23.229 122.193.64.145 106.75.166.71 158.51.96.38 2.189.130.67 188.166.211.175 96.44.161.98 124.174.58.106 172.245.43.228 111.67.19.59 103.139.101.114 42.4.62.108 161.129.211.63 106.13.57.206 205.185.126.219 203.154.14.8 217.18.94.226 121.228.250.70 112.53.123.177 65.181.92.228 101.36.228.201 219.248.115.178 45.234.176.26 203.186.60.250 129.212.239.56 140.206.107.98 203.189.196.168 170.84.39.236 106.75.216.134 103.219.32.239 103.166.226.235 114.218.57.21 51.195.223.189 177.74.153.10 180.108.46.6 3.92.224.153 &"
  ],
  "detailed_commands": [
    {
      "cmd": "chmod +x ./.6335344173072655702/sshd;nohup ./.6335344173072655702/sshd 191.252.210.242 77.239.125.227 27.0.135.12 45.118.144.36 218.98.97.7 154.211.13.102 188.248.254.9 31.77.145.89 165.232.148.95 192.140.185.8 138.99.79.29 106.13.167.239 177.70.2.194 45.126.120.53 223.243.162.130 202.134.23.229 122.193.64.145 106.75.166.71 158.51.96.38 2.189.130.67 188.166.211.175 96.44.161.98 124.174.58.106 172.245.43.228 111.67.19.59 103.139.101.114 42.4.62.108 161.129.211.63 106.13.57.206 205.185.126.219 203.154.14.8 217.18.94.226 121.228.250.70 112.53.123.177 65.181.92.228 101.36.228.201 219.248.115.178 45.234.176.26 203.186.60.250 129.212.239.56 140.206.107.98 203.189.196.168 170.84.39.236 106.75.216.134 103.219.32.239 103.166.226.235 114.218.57.21 51.195.223.189 177.74.153.10 180.108.46.6 3.92.224.153 &",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
193.46.255.86
2026-08-19 22:03:32.957739 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / qweasdzxc123

Record ID: 50f360dc8d3f
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.0s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "50f360dc8d3f",
  "src_ip": "193.46.255.86",
  "start_time": "2026-08-19T22:03:32.957739Z",
  "end_time": "2026-08-19T22:03:38.976588Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "qweasdzxc123"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
223.181.77.193
2026-08-19 21:53:10.216319 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a316cdd67ddd
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "a316cdd67ddd",
  "src_ip": "223.181.77.193",
  "start_time": "2026-08-19T21:53:10.216319Z",
  "end_time": "2026-08-19T21:53:10.219674Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
223.181.77.193
2026-08-19 21:52:51.662132 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d247bb33a046
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "d247bb33a046",
  "src_ip": "223.181.77.193",
  "start_time": "2026-08-19T21:52:51.662132Z",
  "end_time": "2026-08-19T21:52:51.665473Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
176.53.159.196
2026-08-19 21:52:10.296458 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: bf5cfe11a974
Client Version: SSH-2.0-Go
Engagement Duration: 1.2s
HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53
{
  "id": "bf5cfe11a974",
  "src_ip": "176.53.159.196",
  "start_time": "2026-08-19T21:52:10.296458Z",
  "end_time": "2026-08-19T21:52:11.473346Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
123.58.209.194
2026-08-19 21:48:37.744012 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: efff7e883994
Client Version: SSH-2.0-Go
Engagement Duration: 15.0s
HASSH Fingerprint: 2aec6b44b06bec95d73f66b5d30cb69a
{
  "id": "efff7e883994",
  "src_ip": "123.58.209.194",
  "start_time": "2026-08-19T21:48:37.744012Z",
  "end_time": "2026-08-19T21:48:52.743889Z",
  "duration": "15.0",
  "version": "SSH-2.0-Go",
  "hassh": "2aec6b44b06bec95d73f66b5d30cb69a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
123.58.209.194
2026-08-19 21:48:37.364964 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ff69e7a53476
Client Version: Unknown
Engagement Duration: 0.8s
{
  "id": "ff69e7a53476",
  "src_ip": "123.58.209.194",
  "start_time": "2026-08-19T21:48:37.364964Z",
  "end_time": "2026-08-19T21:48:38.128801Z",
  "duration": "0.8",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
138.121.107.116
2026-08-19 21:46:40.886300 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c10efa21013a
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "c10efa21013a",
  "src_ip": "138.121.107.116",
  "start_time": "2026-08-19T21:46:40.886300Z",
  "end_time": "2026-08-19T21:46:40.889575Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
138.121.107.116
2026-08-19 21:46:20.983979 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 295178e0d736
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "295178e0d736",
  "src_ip": "138.121.107.116",
  "start_time": "2026-08-19T21:46:20.983979Z",
  "end_time": "2026-08-19T21:46:20.987761Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
217.60.255.130
2026-08-19 21:45:36.690349 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / root@123

Record ID: f9c01ca291c9
Client Version: SSH-2.0-libssh_0.10.4
Engagement Duration: 2.0s
HASSH Fingerprint: 419da4c91ddbffebead14645bebc93b9
{
  "id": "f9c01ca291c9",
  "src_ip": "217.60.255.130",
  "start_time": "2026-08-19T21:45:36.690349Z",
  "end_time": "2026-08-19T21:45:38.735139Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.10.4",
  "hassh": "419da4c91ddbffebead14645bebc93b9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root@123"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
20.65.194.111
2026-08-19 21:45:15.194201 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 19cb1befd2e0
Client Version: MGLNDD_184.98.6.225_22
Engagement Duration: 0.0s
{
  "id": "19cb1befd2e0",
  "src_ip": "20.65.194.111",
  "start_time": "2026-08-19T21:45:15.194201Z",
  "end_time": "2026-08-19T21:45:15.199741Z",
  "duration": "0.0",
  "version": "MGLNDD_184.98.6.225_22",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
20.65.194.111
2026-08-19 21:45:15.054328 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c79245733c7d
Client Version: SSH-2.0-Go
Engagement Duration: 10.0s
HASSH Fingerprint: 084386fa7ae5039bcf6f07298a05a227
{
  "id": "c79245733c7d",
  "src_ip": "20.65.194.111",
  "start_time": "2026-08-19T21:45:15.054328Z",
  "end_time": "2026-08-19T21:45:25.063106Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "084386fa7ae5039bcf6f07298a05a227",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
116.74.164.106
2026-08-19 21:40:33.235569 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 54321

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec
Record ID: 55aa1d03ea2c
Client Version: SSH-2.0-Go
Engagement Duration: 1.9s
HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6
{
  "id": "55aa1d03ea2c",
  "src_ip": "116.74.164.106",
  "start_time": "2026-08-19T21:40:33.235569Z",
  "end_time": "2026-08-19T21:40:35.091446Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "54321"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
2.57.121.25
2026-08-19 21:27:26.312223 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / 3214

Record ID: 190012028b8b
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.0s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "190012028b8b",
  "src_ip": "2.57.121.25",
  "start_time": "2026-08-19T21:27:26.312223Z",
  "end_time": "2026-08-19T21:27:32.327608Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "3214"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
23.175.50.52
2026-08-19 21:19:23.822687 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: user / kisan

Record ID: 5c85bcb2dae5
Client Version: SSH-2.0-PuTTY_Release_0.70
Engagement Duration: 1.0s
HASSH Fingerprint: 0425c279610910d2d9aef3b285e59b86
{
  "id": "5c85bcb2dae5",
  "src_ip": "23.175.50.52",
  "start_time": "2026-08-19T21:19:23.822687Z",
  "end_time": "2026-08-19T21:19:24.861239Z",
  "duration": "1.0",
  "version": "SSH-2.0-PuTTY_Release_0.70",
  "hassh": "0425c279610910d2d9aef3b285e59b86",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "kisan"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
2.57.121.112
2026-08-19 21:18:57.103019 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: niklas

Record ID: 8fd3498f1792
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.5s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "8fd3498f1792",
  "src_ip": "2.57.121.112",
  "start_time": "2026-08-19T21:18:57.103019Z",
  "end_time": "2026-08-19T21:19:03.636950Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "niklas",
      "pass": "niklas"
    },
    {
      "user": "niklas",
      "pass": "niklas1"
    },
    {
      "user": "niklas",
      "pass": "niklas123"
    },
    {
      "user": "niklas",
      "pass": "niklas1234"
    },
    {
      "user": "niklas",
      "pass": "niklas12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
217.60.255.130
2026-08-19 21:17:37.701052 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / root

Record ID: f6e465d6a145
Client Version: SSH-2.0-libssh_0.10.4
Engagement Duration: 2.5s
HASSH Fingerprint: 419da4c91ddbffebead14645bebc93b9
{
  "id": "f6e465d6a145",
  "src_ip": "217.60.255.130",
  "start_time": "2026-08-19T21:17:37.701052Z",
  "end_time": "2026-08-19T21:17:40.225700Z",
  "duration": "2.5",
  "version": "SSH-2.0-libssh_0.10.4",
  "hassh": "419da4c91ddbffebead14645bebc93b9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
139.19.117.130
2026-08-19 21:17:02.120792 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: admin

Record ID: ceae74043ec0
Client Version: SSH-2.0-Go
Engagement Duration: 10.0s
HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532
{
  "id": "ceae74043ec0",
  "src_ip": "139.19.117.130",
  "start_time": "2026-08-19T21:17:02.120792Z",
  "end_time": "2026-08-19T21:17:12.120122Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "admin",
      "pass": null
    },
    {
      "user": "admin",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
193.32.162.15
2026-08-19 21:09:25.757546 UTC
COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 200

Credential acceptance event recorded. Target authentication: root / root123

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
[obs-node]:~$ uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null
Command not found: /usr/bin/uname -s -v -n -m
[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ ( [ -f /proc/version ]
[obs-node]:~$ [ -f /proc/version ]
[obs-node]:~$ head -1 /proc/version | cut -d -f1
[obs-node]:~$ [ -f /etc/os-release ]
Record ID: ed179dfc035f
Client Version: SSH-2.0-Go
Engagement Duration: 2.9s
HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5
{
  "id": "ed179dfc035f",
  "src_ip": "193.32.162.15",
  "start_time": "2026-08-19T21:09:25.757546Z",
  "end_time": "2026-08-19T21:09:28.615141Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root123"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}
193.32.162.15
2026-08-19 21:08:17.045313 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: test3

Record ID: 8f54e4fec45d
Client Version: SSH-2.0-Go
Engagement Duration: 3.4s
HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5
{
  "id": "8f54e4fec45d",
  "src_ip": "193.32.162.15",
  "start_time": "2026-08-19T21:08:17.045313Z",
  "end_time": "2026-08-19T21:08:20.476923Z",
  "duration": "3.4",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [
    {
      "user": "test3",
      "pass": "test3"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
193.32.162.15
2026-08-19 21:07:08.740860 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: test2

Record ID: d1705852a9c9
Client Version: SSH-2.0-Go
Engagement Duration: 4.2s
HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5
{
  "id": "d1705852a9c9",
  "src_ip": "193.32.162.15",
  "start_time": "2026-08-19T21:07:08.740860Z",
  "end_time": "2026-08-19T21:07:12.964747Z",
  "duration": "4.2",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [
    {
      "user": "test2",
      "pass": "test2"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
193.32.162.15
2026-08-19 21:05:58.894864 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: test1

Record ID: 9d9482594559
Client Version: SSH-2.0-Go
Engagement Duration: 4.8s
HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5
{
  "id": "9d9482594559",
  "src_ip": "193.32.162.15",
  "start_time": "2026-08-19T21:05:58.894864Z",
  "end_time": "2026-08-19T21:06:03.733390Z",
  "duration": "4.8",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [
    {
      "user": "test1",
      "pass": "test1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
193.32.162.15
2026-08-19 21:04:29.111059 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 3f7c16905ed7
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "3f7c16905ed7",
  "src_ip": "193.32.162.15",
  "start_time": "2026-08-19T21:04:29.111059Z",
  "end_time": "2026-08-19T21:04:29.284926Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
121.29.5.109
2026-08-19 21:00:37.234565 UTC
COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / ------fuck------

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -m
Record ID: e42e59fe8ad7
Client Version: SSH-2.0-Go
Engagement Duration: 1.6s
HASSH Fingerprint: 98f63c4d9c87edbd97ed4747fa031019
{
  "id": "e42e59fe8ad7",
  "src_ip": "121.29.5.109",
  "start_time": "2026-08-19T21:00:37.234565Z",
  "end_time": "2026-08-19T21:00:38.847721Z",
  "duration": "1.6",
  "version": "SSH-2.0-Go",
  "hassh": "98f63c4d9c87edbd97ed4747fa031019",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "\ufeff------fuck------"
  },
  "commands": [
    "uname -s -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}
121.29.5.109
2026-08-19 21:00:36.813452 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 56df75e1bb66
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "56df75e1bb66",
  "src_ip": "121.29.5.109",
  "start_time": "2026-08-19T21:00:36.813452Z",
  "end_time": "2026-08-19T21:00:37.017529Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
23.175.50.52
2026-08-19 20:58:15.235291 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: user / kisan

Record ID: 1de75b607bd2
Client Version: SSH-2.0-PuTTY_Release_0.70
Engagement Duration: 1.1s
HASSH Fingerprint: 0425c279610910d2d9aef3b285e59b86
{
  "id": "1de75b607bd2",
  "src_ip": "23.175.50.52",
  "start_time": "2026-08-19T20:58:15.235291Z",
  "end_time": "2026-08-19T20:58:16.306919Z",
  "duration": "1.1",
  "version": "SSH-2.0-PuTTY_Release_0.70",
  "hassh": "0425c279610910d2d9aef3b285e59b86",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "kisan"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}