Below is an excerpt from an authentication log on a made-up server.
Something happened here that a rate limit would not have caught, because the attacker was patient. Work out which account was actually compromised — not merely attacked — and submit its username as the flag in the form skrd{username}.
Read the log twice. The first pass shows you the noise; the second shows you the one line that is different.
2026-03-11T01:02:14Z sshd[2211]: Failed password for admin from 203.0.113.44 port 51122 2026-03-11T01:14:51Z sshd[2213]: Failed password for admin from 203.0.113.44 port 51140 2026-03-11T01:29:03Z sshd[2219]: Failed password for root from 203.0.113.44 port 51166 2026-03-11T01:41:38Z sshd[2224]: Failed password for backup from 203.0.113.44 port 51190 2026-03-11T01:55:12Z sshd[2231]: Failed password for admin from 203.0.113.44 port 51204 2026-03-11T02:08:47Z sshd[2240]: Failed password for j.karim from 203.0.113.44 port 51233 2026-03-11T02:21:19Z sshd[2246]: Failed password for backup from 203.0.113.44 port 51261 2026-03-11T02:33:55Z sshd[2251]: Accepted password for s.rashid from 203.0.113.44 port 51288 2026-03-11T02:34:02Z sshd[2251]: pam_unix(sshd:session): session opened for user s.rashid 2026-03-11T02:34:40Z sudo[2260]: s.rashid : TTY=pts/0 ; PWD=/home/s.rashid ; USER=root ; COMMAND=/usr/bin/id 2026-03-11T02:47:11Z sshd[2266]: Failed password for admin from 203.0.113.44 port 51310 2026-03-11T03:01:44Z sshd[2271]: Failed password for root from 203.0.113.44 port 51339
Every line but one says Failed. Attacks are loud; the successful login is the quiet part.