The quiet hour

Easy · 10 points

An authentication log from a made-up server, covering one night and the following morning.

Somebody was patient. The volume is low enough that a rate limit would not have fired, and spread out enough that nobody watching in real time would have noticed.

Several accounts signed in successfully during this period and almost all of them are people arriving at work. One is not. Work out which account was actually compromised — not merely attacked — and submit its username: skrd{username}.

Counting one field shows you the shape of the attack. It does not give you the answer — for that, count a second field and ask which success does not belong with the others.

Artefact

2026-03-11T01:04:09Z sshd[2202]: Failed password for admin from 203.0.113.44 port 51100
2026-03-11T01:06:44Z sshd[2204]: Failed password for root from 203.0.113.44 port 51107
2026-03-11T01:07:32Z sshd[2205]: Failed password for backup from 203.0.113.44 port 51114
2026-03-11T01:09:24Z sshd[2210]: Failed password for j.karim from 203.0.113.44 port 51121
2026-03-11T01:10:45Z sshd[2211]: Failed password for n.barzan from 203.0.113.44 port 51128
2026-03-11T01:12:12Z sshd[2214]: Failed password for operator from 203.0.113.44 port 51135
2026-03-11T01:14:42Z sshd[2219]: Failed password for postgres from 203.0.113.44 port 51142
2026-03-11T01:17:12Z sshd[2223]: Failed password for s.rashid from 203.0.113.44 port 51149
2026-03-11T01:19:49Z sshd[2227]: Failed password for www-data from 203.0.113.44 port 51156
2026-03-11T01:21:52Z sshd[2230]: Failed password for z.karim from 203.0.113.44 port 51163
2026-03-11T01:24:06Z sshd[2231]: Failed password for admin from 203.0.113.44 port 51170
2026-03-11T01:25:52Z sshd[2236]: Failed password for root from 203.0.113.44 port 51177
2026-03-11T01:27:17Z sshd[2239]: Failed password for backup from 203.0.113.44 port 51184
2026-03-11T01:29:54Z sshd[2243]: Failed password for j.karim from 203.0.113.44 port 51191
2026-03-11T01:31:00Z sshd[2246]: Failed password for n.barzan from 203.0.113.44 port 51198
2026-03-11T01:32:42Z sshd[2248]: Failed password for operator from 203.0.113.44 port 51205
2026-03-11T01:35:22Z sshd[2249]: Failed password for postgres from 203.0.113.44 port 51212
2026-03-11T01:36:04Z sshd[2251]: Failed password for s.rashid from 203.0.113.44 port 51219
2026-03-11T01:37:57Z sshd[2254]: Failed password for www-data from 203.0.113.44 port 51226
2026-03-11T01:39:51Z sshd[2258]: Failed password for z.karim from 203.0.113.44 port 51233
2026-03-11T01:42:20Z sshd[2263]: Failed password for admin from 203.0.113.44 port 51240
2026-03-11T01:43:29Z sshd[2264]: Failed password for root from 203.0.113.44 port 51247
2026-03-11T01:44:17Z sshd[2267]: Failed password for backup from 203.0.113.44 port 51254
2026-03-11T01:46:18Z sshd[2272]: Failed password for j.karim from 203.0.113.44 port 51261
2026-03-11T01:47:02Z sshd[2273]: Failed password for n.barzan from 203.0.113.44 port 51268
2026-03-11T01:48:24Z sshd[2275]: Failed password for operator from 203.0.113.44 port 51275
2026-03-11T01:49:25Z sshd[2279]: Failed password for postgres from 203.0.113.44 port 51282
2026-03-11T01:51:17Z sshd[2284]: Failed password for s.rashid from 203.0.113.44 port 51289
2026-03-11T01:52:57Z sshd[2285]: Failed password for www-data from 203.0.113.44 port 51296
2026-03-11T01:55:40Z sshd[2288]: Failed password for z.karim from 203.0.113.44 port 51303
2026-03-11T01:57:23Z sshd[2292]: Failed password for admin from 203.0.113.44 port 51310
2026-03-11T01:59:34Z sshd[2297]: Failed password for root from 203.0.113.44 port 51317
2026-03-11T02:02:13Z sshd[2298]: Failed password for backup from 203.0.113.44 port 51324
2026-03-11T02:04:19Z sshd[2300]: Failed password for j.karim from 203.0.113.44 port 51331
2026-03-11T02:06:01Z sshd[2305]: Failed password for n.barzan from 203.0.113.44 port 51338
2026-03-11T02:07:19Z sshd[2307]: Failed password for operator from 203.0.113.44 port 51345
2026-03-11T02:09:27Z sshd[2312]: Failed password for postgres from 203.0.113.44 port 51352
2026-03-11T02:12:33Z sshd[2313]: Failed password for s.rashid from 203.0.113.44 port 51359
2026-03-11T02:14:55Z sshd[2315]: Failed password for www-data from 203.0.113.44 port 51366
2026-03-11T02:17:40Z sshd[2319]: Failed password for z.karim from 203.0.113.44 port 51373
2026-03-11T02:20:14Z sshd[2320]: Failed password for admin from 203.0.113.44 port 51380
2026-03-11T02:21:21Z sshd[2324]: Failed password for root from 203.0.113.44 port 51387
2026-03-11T02:23:14Z sshd[2327]: Failed password for backup from 203.0.113.44 port 51394
2026-03-11T02:23:59Z sshd[2332]: Failed password for j.karim from 203.0.113.44 port 51401
2026-03-11T02:24:42Z sshd[2334]: Failed password for n.barzan from 203.0.113.44 port 51408
2026-03-11T02:26:12Z sshd[2337]: Failed password for operator from 203.0.113.44 port 51415
2026-03-11T02:27:22Z sshd[2338]: Failed password for postgres from 203.0.113.44 port 51422
2026-03-11T02:30:02Z sshd[2343]: Failed password for s.rashid from 203.0.113.44 port 51429
2026-03-11T02:31:56Z sshd[2348]: Failed password for www-data from 203.0.113.44 port 51436
2026-03-11T02:33:55Z sshd[2426]: Accepted password for s.rashid from 203.0.113.44 port 51443
2026-03-11T02:34:29Z sshd[2352]: Failed password for z.karim from 203.0.113.44 port 51450
2026-03-11T02:37:29Z sshd[2357]: Failed password for admin from 203.0.113.44 port 51457
2026-03-11T02:39:00Z sshd[2362]: Failed password for root from 203.0.113.44 port 51464
2026-03-11T02:39:59Z sshd[2367]: Failed password for backup from 203.0.113.44 port 51471
2026-03-11T02:41:36Z sshd[2371]: Failed password for j.karim from 203.0.113.44 port 51478
2026-03-11T02:43:13Z sshd[2372]: Failed password for n.barzan from 203.0.113.44 port 51485
2026-03-11T02:44:00Z sshd[2377]: Failed password for operator from 203.0.113.44 port 51492
2026-03-11T02:45:44Z sshd[2380]: Failed password for postgres from 203.0.113.44 port 51499
2026-03-11T02:48:18Z sshd[2383]: Failed password for s.rashid from 203.0.113.44 port 51506
2026-03-11T02:49:00Z sshd[2387]: Failed password for www-data from 203.0.113.44 port 51513
2026-03-11T02:51:37Z sshd[2388]: Failed password for z.karim from 203.0.113.44 port 51520
2026-03-11T02:53:08Z sshd[2389]: Failed password for admin from 203.0.113.44 port 51527
2026-03-11T02:56:13Z sshd[2392]: Failed password for root from 203.0.113.44 port 51534
2026-03-11T02:56:59Z sshd[2393]: Failed password for backup from 203.0.113.44 port 51541
2026-03-11T02:58:59Z sshd[2398]: Failed password for j.karim from 203.0.113.44 port 51548
2026-03-11T03:00:09Z sshd[2399]: Failed password for n.barzan from 203.0.113.44 port 51555
2026-03-11T03:02:31Z sshd[2402]: Failed password for operator from 203.0.113.44 port 51562
2026-03-11T03:03:57Z sshd[2404]: Failed password for postgres from 203.0.113.44 port 51569
2026-03-11T03:05:58Z sshd[2407]: Failed password for s.rashid from 203.0.113.44 port 51576
2026-03-11T03:07:50Z sshd[2411]: Failed password for www-data from 203.0.113.44 port 51583
2026-03-11T03:10:16Z sshd[2414]: Failed password for z.karim from 203.0.113.44 port 51590
2026-03-11T03:12:57Z sshd[2418]: Failed password for admin from 203.0.113.44 port 51597
2026-03-11T03:16:00Z sshd[2419]: Failed password for root from 203.0.113.44 port 51604
2026-03-11T03:18:51Z sshd[2420]: Failed password for backup from 203.0.113.44 port 51611
2026-03-11T03:20:58Z sshd[2423]: Failed password for j.karim from 203.0.113.44 port 51618
2026-03-11T08:40:41Z sshd[2433]: Accepted password for a.hassan from 10.4.1.12 port 51625
2026-03-11T08:47:12Z sshd[2434]: Accepted password for d.ibrahim from 10.4.1.22 port 51632
2026-03-11T08:54:34Z sshd[2435]: Accepted password for j.karim from 10.4.1.31 port 51639
2026-03-11T09:01:25Z sshd[2436]: Accepted password for n.barzan from 10.4.1.56 port 51646

Hint

Count by result: 74 failures and 5 successes, which tells you the shape and not the answer. Then count by source address. Four of the successes came from the office range; one came from the same address as every single failure.