Adversarial Observation Interface

91.92.40.217

2026-07-09 06:20:25.866469 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cloud

Record ID: 6a79c82dfb20

Client Version: SSH-2.0-Go

Engagement Duration: 4.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "6a79c82dfb20",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:20:25.866469Z",
  "end_time": "2026-07-09T06:20:29.932523Z",
  "duration": "4.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "cloud",
      "pass": "1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:20:20.283266 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tom

Record ID: a7ee96cba199

Client Version: SSH-2.0-Go

Engagement Duration: 2.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "a7ee96cba199",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:20:20.283266Z",
  "end_time": "2026-07-09T06:20:23.137510Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "tom",
      "pass": "111111"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:20:13.932237 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / momo123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: f604f95d21b6

Client Version: SSH-2.0-Go

Engagement Duration: 3.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "f604f95d21b6",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:20:13.932237Z",
  "end_time": "2026-07-09T06:20:17.003326Z",
  "duration": "3.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "momo123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:20:07.199920 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sysupdate

Record ID: 7303d978d717

Client Version: SSH-2.0-Go

Engagement Duration: 2.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "7303d978d717",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:20:07.199920Z",
  "end_time": "2026-07-09T06:20:10.112581Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "sysupdate",
      "pass": "Password1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:59.286500 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: user / 12345

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: a87548a4ea60

Client Version: SSH-2.0-Go

Engagement Duration: 4.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "a87548a4ea60",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:59.286500Z",
  "end_time": "2026-07-09T06:20:03.437698Z",
  "duration": "4.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "12345"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:53.038750 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gg

Record ID: 4e42eba365c5

Client Version: SSH-2.0-Go

Engagement Duration: 5.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "4e42eba365c5",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:53.038750Z",
  "end_time": "2026-07-09T06:19:58.898962Z",
  "duration": "5.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "gg",
      "pass": "gg"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:46.741451 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tomcat

Record ID: fe36b071d89f

Client Version: SSH-2.0-Go

Engagement Duration: 4.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "fe36b071d89f",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:46.741451Z",
  "end_time": "2026-07-09T06:19:51.600520Z",
  "duration": "4.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "tomcat",
      "pass": "tomcat"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:39.128512 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pi

Record ID: 51e1cf7e9984

Client Version: SSH-2.0-Go

Engagement Duration: 7.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "51e1cf7e9984",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:39.128512Z",
  "end_time": "2026-07-09T06:19:46.869070Z",
  "duration": "7.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "pi",
      "pass": "root"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:33.250536 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: developer

Record ID: 80580d8f0cd5

Client Version: SSH-2.0-Go

Engagement Duration: 6.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "80580d8f0cd5",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:33.250536Z",
  "end_time": "2026-07-09T06:19:40.132643Z",
  "duration": "6.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "developer",
      "pass": "developer"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:27.264062 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: admin / !QAZ2wsx

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: c4ee92c70da2

Client Version: SSH-2.0-Go

Engagement Duration: 6.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "c4ee92c70da2",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:27.264062Z",
  "end_time": "2026-07-09T06:19:33.791122Z",
  "duration": "6.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "!QAZ2wsx"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:20.947485 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / root1234

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: ebf78a6efd33

Client Version: SSH-2.0-Go

Engagement Duration: 3.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "ebf78a6efd33",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:20.947485Z",
  "end_time": "2026-07-09T06:19:24.758545Z",
  "duration": "3.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root1234"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:15.065814 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / P@55w0rd

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: e336d3446ca6

Client Version: SSH-2.0-Go

Engagement Duration: 2.6s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "e336d3446ca6",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:15.065814Z",
  "end_time": "2026-07-09T06:19:17.714642Z",
  "duration": "2.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "P@55w0rd"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:08.887509 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: bitrix

Record ID: bf6d9113fe64

Client Version: SSH-2.0-Go

Engagement Duration: 2.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "bf6d9113fe64",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:08.887509Z",
  "end_time": "2026-07-09T06:19:11.631122Z",
  "duration": "2.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "bitrix",
      "pass": "bitrix"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:19:02.880140 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: test / 12345678

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 02e5f67bab03

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "02e5f67bab03",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:19:02.880140Z",
  "end_time": "2026-07-09T06:19:05.109820Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "12345678"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:18:56.261523 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: frank

Record ID: 368713ce6fef

Client Version: SSH-2.0-Go

Engagement Duration: 2.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "368713ce6fef",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:18:56.261523Z",
  "end_time": "2026-07-09T06:18:59.212940Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "frank",
      "pass": "frank"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:18:49.757928 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: avax

Record ID: e0a2205e73ab

Client Version: SSH-2.0-Go

Engagement Duration: 2.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "e0a2205e73ab",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:18:49.757928Z",
  "end_time": "2026-07-09T06:18:51.886163Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "avax",
      "pass": "avax"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:18:42.238532 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: claude

Record ID: c6fad25b7935

Client Version: SSH-2.0-Go

Engagement Duration: 2.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "c6fad25b7935",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:18:42.238532Z",
  "end_time": "2026-07-09T06:18:45.040678Z",
  "duration": "2.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "claude",
      "pass": "claude123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:18:35.861499 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ivan

Record ID: f22ac2da0a72

Client Version: SSH-2.0-Go

Engagement Duration: 2.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "f22ac2da0a72",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:18:35.861499Z",
  "end_time": "2026-07-09T06:18:38.773280Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ivan",
      "pass": "ivan"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:18:30.084598 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dev

Record ID: fc313aaada02

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "fc313aaada02",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:18:30.084598Z",
  "end_time": "2026-07-09T06:18:32.131816Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "dev",
      "pass": "dev"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.32.162.84

2026-07-09 06:18:25.990079 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 200

Credential acceptance event recorded. Target authentication: root / 111111

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

[obs-node]:~$ uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null

Command not found: /usr/bin/uname -s -v -n -m

[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ ( [ -f /proc/version ]

[obs-node]:~$ [ -f /proc/version ]

[obs-node]:~$ head -1 /proc/version | cut -d -f1

[obs-node]:~$ [ -f /etc/os-release ]

Record ID: 354ea3d40e2a

Client Version: SSH-2.0-Go

Engagement Duration: 5.2s

HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5

{
  "id": "354ea3d40e2a",
  "src_ip": "193.32.162.84",
  "start_time": "2026-07-09T06:18:25.990079Z",
  "end_time": "2026-07-09T06:18:31.241254Z",
  "duration": "5.2",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "111111"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:18:23.590561 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: ubuntu / Aa123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 0841677bd17a

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "0841677bd17a",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:18:23.590561Z",
  "end_time": "2026-07-09T06:18:25.549709Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "Aa123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:18:16.901901 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: adminuser

Record ID: 56c289eb53b9

Client Version: SSH-2.0-Go

Engagement Duration: 3.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "56c289eb53b9",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:18:16.901901Z",
  "end_time": "2026-07-09T06:18:20.759618Z",
  "duration": "3.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "adminuser",
      "pass": "adminuser"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:18:10.668007 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rdpuser

Record ID: ab1f47bccb95

Client Version: SSH-2.0-Go

Engagement Duration: 3.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "ab1f47bccb95",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:18:10.668007Z",
  "end_time": "2026-07-09T06:18:13.721141Z",
  "duration": "3.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "rdpuser",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:18:04.627569 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / nD6ffS9msOngs

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 9f3282e12345

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "9f3282e12345",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:18:04.627569Z",
  "end_time": "2026-07-09T06:18:06.340107Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "nD6ffS9msOngs"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:59.183637 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user1

Record ID: 5eadce1d3fbc

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "5eadce1d3fbc",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:59.183637Z",
  "end_time": "2026-07-09T06:18:01.398007Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "user1",
      "pass": "123456789"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:52.892541 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: runner

Record ID: 10d5e8facf37

Client Version: SSH-2.0-Go

Engagement Duration: 3.2s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "10d5e8facf37",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:52.892541Z",
  "end_time": "2026-07-09T06:17:56.116206Z",
  "duration": "3.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "runner",
      "pass": "1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:47.014248 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / Test1234

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: d5723e35026b

Client Version: SSH-2.0-Go

Engagement Duration: 2.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "d5723e35026b",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:47.014248Z",
  "end_time": "2026-07-09T06:17:49.808371Z",
  "duration": "2.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Test1234"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:41.261227 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: config

Record ID: 18071585d727

Client Version: SSH-2.0-Go

Engagement Duration: 2.4s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "18071585d727",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:41.261227Z",
  "end_time": "2026-07-09T06:17:43.704443Z",
  "duration": "2.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "config",
      "pass": "config"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:35.061698 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ai

Record ID: 0b2c2f1f6333

Client Version: SSH-2.0-Go

Engagement Duration: 2.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "0b2c2f1f6333",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:35.061698Z",
  "end_time": "2026-07-09T06:17:37.556893Z",
  "duration": "2.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ai",
      "pass": "Aa123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:28.193945 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: splunk

Record ID: 235c974ddef8

Client Version: SSH-2.0-Go

Engagement Duration: 2.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "235c974ddef8",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:28.193945Z",
  "end_time": "2026-07-09T06:17:30.857229Z",
  "duration": "2.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "splunk",
      "pass": "password"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:22.538924 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / root@1234

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: a75aef7a992d

Client Version: SSH-2.0-Go

Engagement Duration: 1.6s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "a75aef7a992d",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:22.538924Z",
  "end_time": "2026-07-09T06:17:24.148069Z",
  "duration": "1.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root@1234"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:16.485725 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: odoo17

Record ID: 68071f6efaa6

Client Version: SSH-2.0-Go

Engagement Duration: 2.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "68071f6efaa6",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:16.485725Z",
  "end_time": "2026-07-09T06:17:18.968561Z",
  "duration": "2.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "odoo17",
      "pass": "odoo17"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:09.800682 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ts

Record ID: 3e6bf9e7ac66

Client Version: SSH-2.0-Go

Engagement Duration: 2.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "3e6bf9e7ac66",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:09.800682Z",
  "end_time": "2026-07-09T06:17:12.284953Z",
  "duration": "2.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ts",
      "pass": "ts"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:17:03.575827 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: frappe

Record ID: d48afc1168e9

Client Version: SSH-2.0-Go

Engagement Duration: 2.6s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "d48afc1168e9",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:17:03.575827Z",
  "end_time": "2026-07-09T06:17:06.127713Z",
  "duration": "2.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "frappe",
      "pass": "admin"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:16:56.813725 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / changeme

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 2d2e2bef4f75

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "2d2e2bef4f75",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:16:56.813725Z",
  "end_time": "2026-07-09T06:16:59.038458Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "changeme"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:16:50.428598 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: admin1

Record ID: f98fa373586f

Client Version: SSH-2.0-Go

Engagement Duration: 2.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "f98fa373586f",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:16:50.428598Z",
  "end_time": "2026-07-09T06:16:53.140216Z",
  "duration": "2.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "admin1",
      "pass": "modzmodz"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:16:43.583008 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 12345678

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: cd7d30aae8d3

Client Version: SSH-2.0-Go

Engagement Duration: 3.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "cd7d30aae8d3",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:16:43.583008Z",
  "end_time": "2026-07-09T06:16:46.619509Z",
  "duration": "3.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "12345678"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:16:37.417526 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: claude

Record ID: 55e250e362f7

Client Version: SSH-2.0-Go

Engagement Duration: 2.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "55e250e362f7",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:16:37.417526Z",
  "end_time": "2026-07-09T06:16:39.915183Z",
  "duration": "2.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "claude",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:16:31.434194 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: username

Record ID: f022b0b08201

Client Version: SSH-2.0-Go

Engagement Duration: 2.4s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "f022b0b08201",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:16:31.434194Z",
  "end_time": "2026-07-09T06:16:33.805655Z",
  "duration": "2.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "username",
      "pass": "user"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:16:25.309537 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: osmc

Record ID: d0ef7cf02ceb

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "d0ef7cf02ceb",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:16:25.309537Z",
  "end_time": "2026-07-09T06:16:27.469030Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "osmc",
      "pass": "osmc"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:16:17.209946 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / test@123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 66295376331f

Client Version: SSH-2.0-Go

Engagement Duration: 3.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "66295376331f",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:16:17.209946Z",
  "end_time": "2026-07-09T06:16:21.153718Z",
  "duration": "3.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "test@123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:16:10.320517 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: developer

Record ID: 3dc632c32117

Client Version: SSH-2.0-Go

Engagement Duration: 4.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "3dc632c32117",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:16:10.320517Z",
  "end_time": "2026-07-09T06:16:14.434641Z",
  "duration": "4.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "developer",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:16:03.989325 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: student

Record ID: 24c3522e11bf

Client Version: SSH-2.0-Go

Engagement Duration: 3.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "24c3522e11bf",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:16:03.989325Z",
  "end_time": "2026-07-09T06:16:07.310442Z",
  "duration": "3.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "student",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:15:57.980661 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: parsa

Record ID: e834577379a8

Client Version: SSH-2.0-Go

Engagement Duration: 2.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "e834577379a8",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:15:57.980661Z",
  "end_time": "2026-07-09T06:16:00.659450Z",
  "duration": "2.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "parsa",
      "pass": "parsa"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.32.162.84

2026-07-09 06:15:53.590595 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 200

Credential acceptance event recorded. Target authentication: root / !root

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

[obs-node]:~$ uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null

Command not found: /usr/bin/uname -s -v -n -m

[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ ( [ -f /proc/version ]

[obs-node]:~$ [ -f /proc/version ]

[obs-node]:~$ head -1 /proc/version | cut -d -f1

[obs-node]:~$ [ -f /etc/os-release ]

Record ID: af902beccd95

Client Version: SSH-2.0-Go

Engagement Duration: 5.1s

HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5

{
  "id": "af902beccd95",
  "src_ip": "193.32.162.84",
  "start_time": "2026-07-09T06:15:53.590595Z",
  "end_time": "2026-07-09T06:15:58.700177Z",
  "duration": "5.1",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "!root"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:15:50.932395 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rock

Record ID: d5f48741aabc

Client Version: SSH-2.0-Go

Engagement Duration: 4.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "d5f48741aabc",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:15:50.932395Z",
  "end_time": "2026-07-09T06:15:55.457775Z",
  "duration": "4.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "rock",
      "pass": "rock"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:15:44.728423 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: vncuser

Record ID: 0f4ee8528632

Client Version: SSH-2.0-Go

Engagement Duration: 3.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "0f4ee8528632",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:15:44.728423Z",
  "end_time": "2026-07-09T06:15:47.729522Z",
  "duration": "3.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "vncuser",
      "pass": "vncuser"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:15:38.746402 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: developer

Record ID: 4485d024ff80

Client Version: SSH-2.0-Go

Engagement Duration: 2.6s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "4485d024ff80",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:15:38.746402Z",
  "end_time": "2026-07-09T06:15:41.344462Z",
  "duration": "2.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "developer",
      "pass": "12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:15:32.422831 UTC

RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: support / Passw0rd

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: dad7ebac2a1e

Client Version: SSH-2.0-Go

Engagement Duration: 2.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "dad7ebac2a1e",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:15:32.422831Z",
  "end_time": "2026-07-09T06:15:35.293010Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "Passw0rd"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-09 06:15:26.394837 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rajvir

Record ID: df51695f6674

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "df51695f6674",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-09T06:15:26.394837Z",
  "end_time": "2026-07-09T06:15:28.339831Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "rajvir",
      "pass": "rajvir123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}