{"id":"bd4e374a-71a3-4f10-9577-2f0b994ae77a","name":"proud-whispering-adder","protocol":"ssh","channel_kind":"exec","src_ip":"211.221.196.103","src_port":36928,"username":"deploy","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":606,"probe_flagged":0,"exec_command":"uname -a","started_at":"2026-08-23T12:58:24.747263+00:00","ended_at":"2026-08-23T12:58:25.825009+00:00","ended_reason":"exec complete","commands":6,"transcript_bytes":2652,"events":[{"seq":1,"at":"2026-08-23T12:58:15.811120+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":2,"at":"2026-08-23T12:58:15.811915+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":3,"at":"2026-08-23T12:58:16.214127+00:00","kind":"input","latency_ms":null,"data":"cat /etc/passwd"},{"seq":4,"at":"2026-08-23T12:58:20.747558+00:00","kind":"output","latency_ms":4539,"data":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nsystemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin\nsystemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin\nmessagebus:x:100:102::/nonexistent:/usr/sbin/nologin\npolkitd:x:996:996:polkit:/nonexistent:/usr/sbin/nologin\npostgres:x:110:113:PostgreSQL administrator,,,:/var/lib/postgresql:/usr/sbin/nologin\nsshd:x:111:65534::/run/sshd:/usr/sbin/nologin\nbrumby:x:1000:1000:Brumby Stable Admin:/home/brumby:/bin/bash"},{"seq":5,"at":"2026-08-23T12:58:21.147306+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep processor | wc -l"},{"seq":6,"at":"2026-08-23T12:58:21.149076+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":7,"at":"2026-08-23T12:58:21.756072+00:00","kind":"input","latency_ms":null,"data":"passwd"},{"seq":8,"at":"2026-08-23T12:58:22.573183+00:00","kind":"output","latency_ms":817,"data":"passwd: You may not view or modify password information for root.\npasswd: Authentication token manipulation error\npasswd: password unchanged"},{"seq":9,"at":"2026-08-23T12:58:23.238131+00:00","kind":"input","latency_ms":null,"data":"rm -rf .bash_history;rm -rf /var/run/utmp;rm -rf /var/run/wtmp -;rm -rf /var/log/lastlog;rm -rf /usr/adm/lastlog;rm -rf .bash_history;cd /home;rm -rf yum.log;cd /var/log/;rm -rf wtmp;rm -rf secure;rm -rf lastlog;rm -rf messages;touch messagess;touch wtmp;touch secure;touch lastlog;cd /root;rm -rf .bash_history;touch .bash_history;unset HISTFILE;unset HISTSAVE;history -n;unset WATCH;cd;HISTFILE=/dev/null;history -c && rm -f ~/.bash_history;cd .."},{"seq":10,"at":"2026-08-23T12:58:23.846172+00:00","kind":"output","latency_ms":606,"data":""},{"seq":11,"at":"2026-08-23T12:58:24.748365+00:00","kind":"input","latency_ms":null,"data":"kill -9 $(ps aux | grep xrx |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep biden1 |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep zzh |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep arx645 |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep kthreaddk |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep ab |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep kdevtmpfsi |grep -v grep | awk '{print $2}')"},{"seq":12,"at":"2026-08-23T12:58:25.624791+00:00","kind":"output","latency_ms":875,"data":"kill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process"}],"credentials":[{"username":"deploy","password":"deploy","method":"password","accepted":true,"tier":"common"}]}
{"id":"d8d4986c-595c-49cf-997c-a99158c4685b","name":"languid-idle-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"47.107.183.85","src_port":34854,"username":null,"client_version":"SSH-2.0-Go","auth_attempts":0,"automation":"bot","think_ms":1955,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T06:40:48.583350+00:00","ended_at":"2026-08-20T07:44:44+00:00","ended_reason":"stale: no end frame","commands":3,"transcript_bytes":1960,"events":[{"seq":1,"at":"2026-08-20T06:40:41.019124+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":2,"at":"2026-08-20T06:40:41.020590+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":3,"at":"2026-08-20T06:40:41.568530+00:00","kind":"input","latency_ms":null,"data":"cat /etc/passwd"},{"seq":4,"at":"2026-08-20T06:40:46.629708+00:00","kind":"output","latency_ms":5059,"data":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\npostgres:x:113:120:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash\nsystemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin\nsystemd-resolve:x:997:997:systemd Resolver:/:/usr/sbin/nologin\nftp:x:1000:1000:ftp:/root:/bin/bash\nbrumby:x:1001:1001:Brumby Stable Account:/home/brumby:/bin/bash\nseabiscuit:x:1002:1002:Seabiscuit Stable Account:/home/seabiscuit:/bin/bash\nmarengo:x:1003:1003:Marengo Stable Account:/home/marengo:/bin/bash\ncopenhagen:x:1004:1004:Copenhagen Stable Account:/home/copenhagen:/bin/bash\nbucephalus:x:1005:1005:Bucephalus Stable Account:/home/bucephalus:/bin/bash\npalomino:x:1006:1006:Palomino Stable Account:/home/palomino:/bin/bash\nappaloosa:x:1007:1007:Appaloosa Stable Account:/home/appaloosa:/bin/bash\nclydesdale:x:1008:1008:Clydesdale Stable Account:/home/clydesdale:/bin/bash\nmustang:x:1009:1009:Mustang Stable Account:/home/mustang:/bin/bash\npinto:x:1010:1010:Pinto Stable Account:/home/pinto:/bin/bash"},{"seq":5,"at":"2026-08-20T06:40:48.584967+00:00","kind":"input","latency_ms":null,"data":"passwd"},{"seq":6,"at":"2026-08-20T06:40:49.220528+00:00","kind":"output","latency_ms":636,"data":"New password: \nRetype new password: \npasswd: password updated successfully"}],"credentials":[{"username":"ftp","password":"ftp","method":"password","accepted":true,"tier":"common"}]}
{"id":"ec2b333e-bca8-4398-921f-0dc6980806fd","name":"stoic-silent-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"127.0.0.1","src_port":50628,"username":"root","client_version":"SSH-2.0-AsyncSSH_2.24.0","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"ls -la /opt/stable","started_at":"2026-08-20T06:34:50.105624+00:00","ended_at":"2026-08-20T06:34:51.260988+00:00","ended_reason":"exec complete","commands":5,"transcript_bytes":2024,"events":[{"seq":1,"at":"2026-08-20T06:34:42.556248+00:00","kind":"input","latency_ms":null,"data":"ls -la /opt/stable"},{"seq":2,"at":"2026-08-20T06:34:44.633186+00:00","kind":"output","latency_ms":2074,"data":"total 28\ndrwxr-xr-x  5 root root 4096 Aug 20 03:09 .\ndrwxr-xr-x 18 root root 4096 Aug 20 03:09 ..\ndrwxr-xr-x  2 root root 4096 Aug 20 03:09 bin\ndrwxr-xr-x  3 root root 4096 Aug 20 03:09 src\ndrwxr-xr-x  2 root root 4096 Aug 20 03:09 logs"},{"seq":3,"at":"2026-08-20T06:34:44.640438+00:00","kind":"input","latency_ms":null,"data":"cat /etc/passwd | tail -4"},{"seq":4,"at":"2026-08-20T06:34:45.774928+00:00","kind":"output","latency_ms":1133,"data":"mustang:x:1004:1004::/home/mustang:/bin/bash\npinto:x:1005:1005::/home/pinto:/bin/bash\npostgres:x:111:114:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash\nbrumby:x:1000:1000:Brumby Stable Admin,,,:/home/brumby:/bin/bash"},{"seq":5,"at":"2026-08-20T06:34:45.799616+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":6,"at":"2026-08-20T06:34:47.146812+00:00","kind":"output","latency_ms":1349,"data":"# m h  dom mon dow   command\n17 * * * * /usr/local/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n*/15 * * * * /usr/local/bin/feed-cycle.timer >> /var/log/feed-cycle.log 2>&1\n0 3 * * * /usr/local/bin/gallop-backup.sh >> /var/log/gallop-backup.log 2>&1\n*/5 * * * * /usr/local/bin/bridle-sync >> /var/log/bridle-sync.log 2>&1\n30 2 * * 1 /usr/local/bin/canter-deploy.sh stable_prod >> /var/log/canter-deploy.log 2>&1"},{"seq":7,"at":"2026-08-20T06:34:47.153399+00:00","kind":"input","latency_ms":null,"data":"ps aux | head -7"},{"seq":8,"at":"2026-08-20T06:34:50.101565+00:00","kind":"output","latency_ms":2946,"data":"USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND\nroot           1  0.0  1.1  29036 10480 ?        Ss   03:09   0:01 /sbin/init splash\nroot         612  0.0  0.4  21980  4032 ?        Ss   03:09   0:00 /usr/lib/systemd/systemd-journald\nroot         689  0.0  0.3  18840  3120 ?        Ss   03:09   0:00 /usr/lib/systemd/systemd-udevd\npostgres     744  0.0  2.1 221664 20096 ?        Ss   03:09   0:00 /usr/lib/postgresql/15/bin/postgres -D /var/lib/postgresql/15/main -c config_file=/etc/postgresql/15/main/postgresql.conf\nroot         801  0.0  0.5  11240  4896 ?        Ss   03:09   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;\nroot         812  0.0  0.6  14488  5792 ?        Ss   03:09   0:00 node /opt/stable/src/server.js"},{"seq":9,"at":"2026-08-20T06:34:50.107354+00:00","kind":"input","latency_ms":null,"data":"ls /var/backups"},{"seq":10,"at":"2026-08-20T06:34:51.235231+00:00","kind":"output","latency_ms":1125,"data":"total 16\ndrwxr-xr-x  2 root root 4096 Aug 20 03:12 .\ndrwxr-xr-x 14 root root 4096 Aug 20 03:09 ..\n-rw-r--r--  1 root root  842 Aug 19 23:00 bridle-sync.1.log\n-rw-r--r--  1 root root 1248 Aug 20 02:45 canter-deploy.1.log\n-rw-r--r--  1 root root 2048 Aug 20 03:05 gallop-backup.tar.gz"}],"credentials":[{"username":"root","password":"root","method":"password","accepted":true,"tier":"common"}]}