Adversarial Observation Interface

91.92.40.217

2026-07-27 13:22:05.451752 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / P@ssword

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: c26dc013dc38

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "c26dc013dc38",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:22:05.451752Z",
  "end_time": "2026-07-27T13:22:07.259839Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "P@ssword"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:21:59.626633 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 12345

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 3bebeb7cad11

Client Version: SSH-2.0-Go

Engagement Duration: 1.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "3bebeb7cad11",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:59.626633Z",
  "end_time": "2026-07-27T13:22:01.126828Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "12345"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:21:54.308648 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dev

Record ID: cc219e197980

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "cc219e197980",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:54.308648Z",
  "end_time": "2026-07-27T13:21:56.341123Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "dev",
      "pass": "1qaz2wsx"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:21:48.516702 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: deploy / toor

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 0a00ed100c34

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "0a00ed100c34",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:48.516702Z",
  "end_time": "2026-07-27T13:21:49.907744Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "deploy",
    "pass": "toor"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:21:42.635735 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: crafty

Record ID: 3aa706978aed

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "3aa706978aed",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:42.635735Z",
  "end_time": "2026-07-27T13:21:44.591666Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "crafty",
      "pass": "crafty"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.121.25

2026-07-27 13:21:40.533105 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / covert

Record ID: 02010966617d

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "02010966617d",
  "src_ip": "2.57.121.25",
  "start_time": "2026-07-27T13:21:40.533105Z",
  "end_time": "2026-07-27T13:21:46.545265Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "covert"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:21:36.826709 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / kali

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 9810cc831776

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "9810cc831776",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:36.826709Z",
  "end_time": "2026-07-27T13:21:38.164393Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "kali"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:21:31.540264 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / linux

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: ddf1aceeaa16

Client Version: SSH-2.0-Go

Engagement Duration: 1.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "ddf1aceeaa16",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:31.540264Z",
  "end_time": "2026-07-27T13:21:33.203555Z",
  "duration": "1.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "linux"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:21:26.306909 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ec2-user

Record ID: c86998e88150

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "c86998e88150",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:26.306909Z",
  "end_time": "2026-07-27T13:21:28.130811Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "ec2-user",
      "pass": "ec2-user"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:21:20.762692 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: amine

Record ID: ed9b3505bd36

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "ed9b3505bd36",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:20.762692Z",
  "end_time": "2026-07-27T13:21:22.732415Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "amine",
      "pass": "amine"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:21:15.175674 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: a45a6a7a7ab8

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "a45a6a7a7ab8",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:15.175674Z",
  "end_time": "2026-07-27T13:21:17.437204Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:21:10.042952 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: botuser

Record ID: c3ca7496eab7

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "c3ca7496eab7",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:10.042952Z",
  "end_time": "2026-07-27T13:21:11.996293Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "botuser",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:21:04.777818 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / Pass@123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 91af71aaf350

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "91af71aaf350",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:21:04.777818Z",
  "end_time": "2026-07-27T13:21:06.162781Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Pass@123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:20:59.269129 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: openclaw

Record ID: 3bdccb2970db

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "3bdccb2970db",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:59.269129Z",
  "end_time": "2026-07-27T13:21:01.148945Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "openclaw",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:20:53.596137 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debian

Record ID: f95a79e04828

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "f95a79e04828",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:53.596137Z",
  "end_time": "2026-07-27T13:20:55.581883Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "debian",
      "pass": "12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:20:48.499477 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: mysql / 123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 9d317dfd97d9

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "9d317dfd97d9",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:48.499477Z",
  "end_time": "2026-07-27T13:20:49.797826Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "mysql",
    "pass": "123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:20:43.349059 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: bot

Record ID: 42a656ae7a1b

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "42a656ae7a1b",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:43.349059Z",
  "end_time": "2026-07-27T13:20:45.175841Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "bot",
      "pass": "111111"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:20:37.579458 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: runner

Record ID: c62d037b6675

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "c62d037b6675",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:37.579458Z",
  "end_time": "2026-07-27T13:20:39.432766Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "runner",
      "pass": "runner"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:20:31.854052 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: docker

Record ID: 43f6dc1a7207

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "43f6dc1a7207",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:31.854052Z",
  "end_time": "2026-07-27T13:20:33.874757Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "docker",
      "pass": "docker123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:20:26.647060 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: guest / abc123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 0c2527b92125

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "0c2527b92125",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:26.647060Z",
  "end_time": "2026-07-27T13:20:27.952047Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "guest",
    "pass": "abc123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:20:21.817575 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / Abc123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: e7bea53bce37

Client Version: SSH-2.0-Go

Engagement Duration: 1.6s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "e7bea53bce37",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:21.817575Z",
  "end_time": "2026-07-27T13:20:23.380753Z",
  "duration": "1.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Abc123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:20:16.695384 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / test1234

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: ea8d318f34ed

Client Version: SSH-2.0-Go

Engagement Duration: 1.4s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "ea8d318f34ed",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:16.695384Z",
  "end_time": "2026-07-27T13:20:18.086769Z",
  "duration": "1.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "test1234"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:20:11.580015 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: erp

Record ID: 022a5b589917

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "022a5b589917",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:11.580015Z",
  "end_time": "2026-07-27T13:20:13.480098Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "erp",
      "pass": "erp"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:20:06.167526 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: john

Record ID: 98e6ac1d05dc

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "98e6ac1d05dc",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:06.167526Z",
  "end_time": "2026-07-27T13:20:07.979845Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "john",
      "pass": "john"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:20:00.779130 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: runner

Record ID: 81827eda65aa

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "81827eda65aa",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:20:00.779130Z",
  "end_time": "2026-07-27T13:20:02.700506Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "runner",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:19:55.602973 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rdpuser

Record ID: 7f0f25e12a38

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "7f0f25e12a38",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:55.602973Z",
  "end_time": "2026-07-27T13:19:57.587710Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "rdpuser",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:19:50.518330 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / Passw0rd

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 51e9451209ec

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "51e9451209ec",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:50.518330Z",
  "end_time": "2026-07-27T13:19:52.335946Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Passw0rd"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

223.123.124.70

2026-07-27 13:19:49.621234 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: sftp_user

Record ID: 39ce48fb72cc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "39ce48fb72cc",
  "src_ip": "223.123.124.70",
  "start_time": "2026-07-27T13:19:49.621234Z",
  "end_time": "2026-07-27T13:19:52.296530Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "sftp_user",
      "pass": "123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:19:45.687543 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: test / test@123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 99acd88a6a29

Client Version: SSH-2.0-Go

Engagement Duration: 1.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "99acd88a6a29",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:45.687543Z",
  "end_time": "2026-07-27T13:19:47.214200Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "test@123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:19:40.561656 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: appuser

Record ID: 3af4b4f26cc2

Client Version: SSH-2.0-Go

Engagement Duration: 1.9s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "3af4b4f26cc2",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:40.561656Z",
  "end_time": "2026-07-27T13:19:42.478839Z",
  "duration": "1.9",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "appuser",
      "pass": "123456"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:19:35.529053 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / P@ssw0rd123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 5927a1893900

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "5927a1893900",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:35.529053Z",
  "end_time": "2026-07-27T13:19:36.785114Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "P@ssw0rd123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:19:30.538546 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / Aa123321

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: efa3ed22f250

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "efa3ed22f250",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:30.538546Z",
  "end_time": "2026-07-27T13:19:31.729969Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Aa123321"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

193.32.162.34

2026-07-27 13:19:26.918616 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 210

Credential acceptance event recorded. Target authentication: admin / adminadmin

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

[obs-node]:~$ uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null

Command not found: /usr/bin/uname -s -v -n -m

[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ ( [ -f /proc/version ]

[obs-node]:~$ [ -f /proc/version ]

[obs-node]:~$ head -1 /proc/version | cut -d -f1

[obs-node]:~$ [ -f /etc/os-release ]

Record ID: 05b08253e5a3

Client Version: SSH-2.0-Go

Engagement Duration: 1m 41s

HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5

{
  "id": "05b08253e5a3",
  "src_ip": "193.32.162.34",
  "start_time": "2026-07-27T13:19:26.918616Z",
  "end_time": "2026-07-27T13:21:07.961392Z",
  "duration": "101.0",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "adminadmin"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 210,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:19:25.242510 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: deployer

Record ID: e3fcd68743ae

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "e3fcd68743ae",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:25.242510Z",
  "end_time": "2026-07-27T13:19:27.493939Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "deployer",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:19:20.556930 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: deploy / !Q2w3e4r

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: f7486bf19997

Client Version: SSH-2.0-Go

Engagement Duration: 1.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "f7486bf19997",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:20.556930Z",
  "end_time": "2026-07-27T13:19:21.853661Z",
  "duration": "1.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "deploy",
    "pass": "!Q2w3e4r"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:19:15.196759 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gd

Record ID: cdc0b3ef54c0

Client Version: SSH-2.0-Go

Engagement Duration: 2.1s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "cdc0b3ef54c0",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:15.196759Z",
  "end_time": "2026-07-27T13:19:17.310348Z",
  "duration": "2.1",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "gd",
      "pass": "gd"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:19:09.855777 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: user / 111

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: b6c189d96475

Client Version: SSH-2.0-Go

Engagement Duration: 1.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "b6c189d96475",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:09.855777Z",
  "end_time": "2026-07-27T13:19:11.362122Z",
  "duration": "1.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "user",
    "pass": "111"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:19:04.253119 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: admin2

Record ID: 0f6a567d5f53

Client Version: SSH-2.0-Go

Engagement Duration: 2.4s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "0f6a567d5f53",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:19:04.253119Z",
  "end_time": "2026-07-27T13:19:06.678041Z",
  "duration": "2.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "admin2",
      "pass": "abc123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:18:58.711855 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: deploy / deploy123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 58aea5fc72e2

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "58aea5fc72e2",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:58.711855Z",
  "end_time": "2026-07-27T13:19:00.477170Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "deploy",
    "pass": "deploy123"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:18:52.936661 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / 1qaz@wsx

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: b926dbc7bb12

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "b926dbc7bb12",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:52.936661Z",
  "end_time": "2026-07-27T13:18:54.758543Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "1qaz@wsx"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:18:47.132179 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / ******

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: eb43455657f0

Client Version: SSH-2.0-Go

Engagement Duration: 2.0s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "eb43455657f0",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:47.132179Z",
  "end_time": "2026-07-27T13:18:49.100777Z",
  "duration": "2.0",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "******"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:18:40.958271 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: amit

Record ID: 6705ff031fad

Client Version: SSH-2.0-Go

Engagement Duration: 2.6s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "6705ff031fad",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:40.958271Z",
  "end_time": "2026-07-27T13:18:43.595267Z",
  "duration": "2.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "amit",
      "pass": "amit"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

193.32.162.34

2026-07-27 13:18:40.766410 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 200

Credential acceptance event recorded. Target authentication: admin / adminroot

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

[obs-node]:~$ uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /bin/uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ /usr/bin/uname -s -v -n -m 2 > /dev/null

Command not found: /usr/bin/uname -s -v -n -m

[obs-node]:~$ busybox uname -s -v -n -m 2 > /dev/null

[obs-node]:~$ ( [ -f /proc/version ]

[obs-node]:~$ [ -f /proc/version ]

[obs-node]:~$ head -1 /proc/version | cut -d -f1

[obs-node]:~$ [ -f /etc/os-release ]

Record ID: a98778b43f09

Client Version: SSH-2.0-Go

Engagement Duration: 15.0s

HASSH Fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5

{
  "id": "a98778b43f09",
  "src_ip": "193.32.162.34",
  "start_time": "2026-07-27T13:18:40.766410Z",
  "end_time": "2026-07-27T13:18:55.727603Z",
  "duration": "15.0",
  "version": "SSH-2.0-Go",
  "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "adminroot"
  },
  "commands": [
    "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
    "uname -s -v -n -m 2 > /dev/null",
    "/bin/uname -s -v -n -m 2 > /dev/null",
    "/usr/bin/uname -s -v -n -m 2 > /dev/null",
    "busybox uname -s -v -n -m 2 > /dev/null",
    "( [ -f /proc/version ]",
    "[ -f /proc/version ]",
    "head -1 /proc/version | cut -d -f1",
    "[ -f /etc/os-release ]"
  ],
  "detailed_commands": [
    {
      "cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
      "failed": true,
      "error": "Command not found: /usr/bin/uname -s -v -n -m"
    },
    {
      "cmd": "busybox uname -s -v -n -m 2 > /dev/null",
      "failed": false,
      "error": null
    },
    {
      "cmd": "( [ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /proc/version ]",
      "failed": false,
      "error": null
    },
    {
      "cmd": "head -1 /proc/version | cut -d -f1",
      "failed": false,
      "error": null
    },
    {
      "cmd": "[ -f /etc/os-release ]",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/usr/bin/uname -s -v -n -m"
  ],
  "score": 200,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:18:34.856138 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pi

Record ID: 2ef50a341901

Client Version: SSH-2.0-Go

Engagement Duration: 2.5s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "2ef50a341901",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:34.856138Z",
  "end_time": "2026-07-27T13:18:37.351355Z",
  "duration": "2.5",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "pi",
      "pass": "root"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:18:28.869848 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cloud

Record ID: e16316613d04

Client Version: SSH-2.0-Go

Engagement Duration: 2.7s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "e16316613d04",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:28.869848Z",
  "end_time": "2026-07-27T13:18:31.579996Z",
  "duration": "2.7",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "cloud",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:18:21.712435 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: crafty

Record ID: 1e3de8865dc4

Client Version: SSH-2.0-Go

Engagement Duration: 2.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "1e3de8865dc4",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:21.712435Z",
  "end_time": "2026-07-27T13:18:24.550584Z",
  "duration": "2.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "crafty",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:18:15.303376 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rocky

Record ID: ee5cbd261226

Client Version: SSH-2.0-Go

Engagement Duration: 2.6s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "ee5cbd261226",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:15.303376Z",
  "end_time": "2026-07-27T13:18:17.918817Z",
  "duration": "2.6",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "rocky",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:18:09.730912 UTC

SUCCESSFUL LOGIN RECONNAISSANCE COMMANDS RUN SCORE: 100

Credential acceptance event recorded. Target authentication: root / qq123456

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ uname -s -v -n -r -m

Record ID: 80b190e1a963

Client Version: SSH-2.0-Go

Engagement Duration: 1.8s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "80b190e1a963",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:09.730912Z",
  "end_time": "2026-07-27T13:18:11.575350Z",
  "duration": "1.8",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "qq123456"
  },
  "commands": [
    "uname -s -v -n -r -m"
  ],
  "detailed_commands": [
    {
      "cmd": "uname -s -v -n -r -m",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 100,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "COMMANDS RUN"
  ]
}

91.92.40.217

2026-07-27 13:18:04.089931 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: debian

Record ID: 88f5f6208d12

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "88f5f6208d12",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:18:04.089931Z",
  "end_time": "2026-07-27T13:18:06.372425Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "debian",
      "pass": "123456789"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

91.92.40.217

2026-07-27 13:17:57.567836 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: app

Record ID: dfc603023fb8

Client Version: SSH-2.0-Go

Engagement Duration: 2.4s

HASSH Fingerprint: 0a07365cc01fa9fc82608ba4019af499

{
  "id": "dfc603023fb8",
  "src_ip": "91.92.40.217",
  "start_time": "2026-07-27T13:17:57.567836Z",
  "end_time": "2026-07-27T13:17:59.999668Z",
  "duration": "2.4",
  "version": "SSH-2.0-Go",
  "hassh": "0a07365cc01fa9fc82608ba4019af499",
  "attempts": [
    {
      "user": "app",
      "pass": "app"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}