{"id":"bd4e374a-71a3-4f10-9577-2f0b994ae77a","name":"proud-whispering-adder","protocol":"ssh","channel_kind":"exec","src_ip":"211.221.196.103","src_port":36928,"username":"deploy","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":606,"probe_flagged":0,"exec_command":"uname -a","started_at":"2026-08-23T12:58:24.747263+00:00","ended_at":"2026-08-23T12:58:25.825009+00:00","ended_reason":"exec complete","commands":6,"transcript_bytes":2652,"events":[{"seq":1,"at":"2026-08-23T12:58:15.811120+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":2,"at":"2026-08-23T12:58:15.811915+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":3,"at":"2026-08-23T12:58:16.214127+00:00","kind":"input","latency_ms":null,"data":"cat /etc/passwd"},{"seq":4,"at":"2026-08-23T12:58:20.747558+00:00","kind":"output","latency_ms":4539,"data":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nsystemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin\nsystemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin\nmessagebus:x:100:102::/nonexistent:/usr/sbin/nologin\npolkitd:x:996:996:polkit:/nonexistent:/usr/sbin/nologin\npostgres:x:110:113:PostgreSQL administrator,,,:/var/lib/postgresql:/usr/sbin/nologin\nsshd:x:111:65534::/run/sshd:/usr/sbin/nologin\nbrumby:x:1000:1000:Brumby Stable Admin:/home/brumby:/bin/bash"},{"seq":5,"at":"2026-08-23T12:58:21.147306+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep processor | wc -l"},{"seq":6,"at":"2026-08-23T12:58:21.149076+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":7,"at":"2026-08-23T12:58:21.756072+00:00","kind":"input","latency_ms":null,"data":"passwd"},{"seq":8,"at":"2026-08-23T12:58:22.573183+00:00","kind":"output","latency_ms":817,"data":"passwd: You may not view or modify password information for root.\npasswd: Authentication token manipulation error\npasswd: password unchanged"},{"seq":9,"at":"2026-08-23T12:58:23.238131+00:00","kind":"input","latency_ms":null,"data":"rm -rf .bash_history;rm -rf /var/run/utmp;rm -rf /var/run/wtmp -;rm -rf /var/log/lastlog;rm -rf /usr/adm/lastlog;rm -rf .bash_history;cd /home;rm -rf yum.log;cd /var/log/;rm -rf wtmp;rm -rf secure;rm -rf lastlog;rm -rf messages;touch messagess;touch wtmp;touch secure;touch lastlog;cd /root;rm -rf .bash_history;touch .bash_history;unset HISTFILE;unset HISTSAVE;history -n;unset WATCH;cd;HISTFILE=/dev/null;history -c && rm -f ~/.bash_history;cd .."},{"seq":10,"at":"2026-08-23T12:58:23.846172+00:00","kind":"output","latency_ms":606,"data":""},{"seq":11,"at":"2026-08-23T12:58:24.748365+00:00","kind":"input","latency_ms":null,"data":"kill -9 $(ps aux | grep xrx |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep biden1 |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep zzh |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep arx645 |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep kthreaddk |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep ab |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep kdevtmpfsi |grep -v grep | awk '{print $2}')"},{"seq":12,"at":"2026-08-23T12:58:25.624791+00:00","kind":"output","latency_ms":875,"data":"kill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process"}],"credentials":[{"username":"deploy","password":"deploy","method":"password","accepted":true,"tier":"common"}]}
{"id":"cfca8c89-ca5e-4dc9-a69d-3d2a4c1e8d89","name":"muted-fearless-tinamou","protocol":"ssh","channel_kind":null,"src_ip":"211.221.196.103","src_port":35816,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-23T12:58:12.134118+00:00","ended_at":"2026-08-23T12:58:14.238006+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"Admin1234","method":"password","accepted":false,"tier":"other"}]}
{"id":"be48da9c-5678-484e-9107-ba677d93e77d","name":"airy-curious-magpie","protocol":"ssh","channel_kind":null,"src_ip":"211.221.196.103","src_port":35012,"username":"admin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-23T12:58:09.788402+00:00","ended_at":"2026-08-23T12:58:11.362007+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"kjashd123sadhj123d1SS","method":"password","accepted":false,"tier":"other"}]}
{"id":"06a66b97-3054-4594-bd93-d283dc5c04b6","name":"rambling-honest-bushbaby","protocol":"ssh","channel_kind":null,"src_ip":"211.221.196.103","src_port":34052,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-23T12:58:07.081121+00:00","ended_at":"2026-08-23T12:58:09.030818+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"kjashd123sadhj123d1SS","method":"password","accepted":false,"tier":"other"}]}